CCM_NG - docrepo

- adds additional classes from docrepo to ccm_ng
- adds two classes with massive errors, sorry, was necessary

git-svn-id: https://svn.libreccm.org/ccm/ccm_ng@3774 8810af33-2d31-482b-a856-94f89814c4df

ccm-core/src/main/java/org/libreccm/auditing/AbstractAuditedEntityRepository.java

@@ -70,14 +70,13 @@ public abstract class AbstractAuditedEntityRepository<K, T>
      * @return A list of revision numbers, at which the entity was modified,
      *         sorted in ascending order (so older revisions come first).
      *
-     * @throws NotAuditedException When entities of the given class are not audited.
+     * @throws NotAuditedException When entities of the given class are not
+     * audited.
      * @throws IllegalArgumentException If cls or primaryKey is null.
      * @throws IllegalStateException If the associated entity manager is closed.
      */
     public List<Number> retrieveRevisionNumbersOfEntity(final T entity,
-                                                        final Long objectId)
-            throws IllegalArgumentException, NotAuditedException,
-            IllegalStateException {
+                                                        final Long objectId) {
         return auditReader.getRevisions(entity.getClass(), objectId);
     }
 

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileActionPane.java

@@ -29,7 +29,6 @@ import com.arsdigita.bebop.event.ActionListener;
 import com.arsdigita.bebop.event.PrintEvent;
 import com.arsdigita.bebop.event.PrintListener;
 import com.arsdigita.dispatcher.DispatcherHelper;
-import com.arsdigita.docrepo.util.GlobalizationUtil;
 import com.arsdigita.globalization.GlobalizedMessage;
 import com.arsdigita.web.Web;
 import org.apache.log4j.Logger;
@@ -38,7 +37,6 @@ import org.libreccm.docrepo.File;
 import org.libreccm.docrepo.ResourceRepository;
 
 import java.io.IOException;
-import java.util.Arrays;
 
 
 /**
@@ -69,23 +67,7 @@ public class FileActionPane extends ColumnPanel implements Constants {
 
         m_parent = parent;
 
-        m_fileData = new RequestLocal() {
-            protected File initialValue(PageState state) {
-                Long fileId = (Long) state.getValue
-                        (FILE_ID_PARAM);
-
-                final CdiUtil cdiUtil = new CdiUtil();
-                final ResourceRepository resourceRepository = cdiUtil
-                        .findBean(ResourceRepository.class);
-                final File file = (File) resourceRepository.findById(fileId);
-                if (file == null) {
-                    log.error(GlobalizationUtil.globalize("db.notfound.file",
-                            Arrays.asList(fileId).toArray()));
-                }
-
-                return file;
-            }
-        };
+        m_fileData = new DocRepoRequestLocal();
 
         m_newVersion = addActionLink(FILE_NEW_VERSION_LINK);
 

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileEditForm.java

@@ -44,8 +44,6 @@ import org.libreccm.docrepo.ResourceRepository;
 
 import java.util.Arrays;
 
-//import com.arsdigita.docrepo.File;
-//import com.arsdigita.docrepo.Folder;
 
 /**
  * This component allows to change the file name and the description of a

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileInfoHistoryPane.java

@@ -24,7 +24,7 @@ import com.arsdigita.bebop.PageState;
 import com.arsdigita.bebop.RequestLocal;
 import com.arsdigita.bebop.SegmentedPanel;
 import com.arsdigita.bebop.SimpleContainer;
-import com.arsdigita.docrepo.File;
+import org.libreccm.docrepo.File;
 import org.apache.log4j.Logger;
 
 /**

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileRevisionsTable.java

@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2001-2004 Red Hat Inc. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+package com.arsdigita.docrepo.ui;
+
+import com.arsdigita.bebop.Component;
+import com.arsdigita.bebop.Label;
+import com.arsdigita.bebop.Link;
+import com.arsdigita.bebop.PageState;
+import com.arsdigita.bebop.Table;
+import com.arsdigita.bebop.event.TableActionEvent;
+import com.arsdigita.bebop.event.TableActionListener;
+import com.arsdigita.bebop.table.TableCellRenderer;
+import com.arsdigita.bebop.table.TableModel;
+import com.arsdigita.bebop.table.TableModelBuilder;
+import org.libreccm.docrepo.File;
+import com.arsdigita.util.LockableImpl;
+import org.apache.log4j.Logger;
+
+/**
+ * This component lists all file revisions in tabular form.
+ * The right-most column has a button to download that particular
+ * version.
+ *
+ * @author <a href="mailto:StefanDeusch@computer.org">Stefan Deusch</a>
+ * @author <a href="mailto:tosmers@uni-bremen.de">Tobias Osmers</a>
+ */
+
+public class FileRevisionsTable extends Table implements TableActionListener,
+        Constants {
+
+    private static Logger log = Logger.getLogger(FileRevisionsTable.class);
+
+    private FileInfoHistoryPane m_parent;
+    private static String[] s_tableHeaders =
+            {"", "Author", "Date", "Comments", ""};
+
+    /**
+     * Constructor. Creates a file revision table for a given file info
+     * history pane.
+     *
+     * @param parent The fileInfoHisoryPane
+     */
+    public FileRevisionsTable(FileInfoHistoryPane parent) {
+
+        super(new FileRevisionsTableModelBuilder(parent), s_tableHeaders);
+        m_parent = parent;
+
+        setClassAttr("AlternateTable");
+        setWidth("100%");
+        setCellRenderers();
+        addTableActionListener(this);
+    }
+
+    public void cellSelected(TableActionEvent e) {
+    }
+
+
+    public void headSelected(TableActionEvent e) {
+        throw new UnsupportedOperationException();
+    }
+
+    private void setCellRenderers() {
+        getColumn(4).setCellRenderer(new LinkRenderer());
+    }
+
+    private final class LinkRenderer implements TableCellRenderer {
+        public Component getComponent(Table table, PageState state,
+                                      Object value, boolean isSelected,
+                                      Object key, int row, int column) {
+            if (value != null) {
+
+                File file = m_parent.getFile(state);
+
+                Link link = new Link("Download", "download/?" + FILE_ID_PARAM
+                        .getName() + "=" + file.getObjectId() + "&trans_id=" + key);
+                link.setClassAttr("downloadLink");
+                return link;
+
+            } else {
+                return new Label();
+            }
+        }
+    }
+
+    private final class FileRevisionsTableModelBuilder extends LockableImpl
+            implements TableModelBuilder {
+
+        private FileInfoHistoryPane m_parent;
+
+        FileRevisionsTableModelBuilder(FileInfoHistoryPane parent) {
+            m_parent = parent;
+        }
+
+        public TableModel makeModel(Table t, PageState state) {
+            return new FileRevisionsTableModel(m_parent.getFile(state), state);
+        }
+    }
+
+    private final class FileRevisionsTableModel implements TableModel,
+            Constants {
+
+        private FileInfoHistoryPane m_parent;
+        private File m_file;
+        private PageState m_state;
+        private TransactionCollection m_tc;
+        private Transaction m_transaction;
+        private Transaction m_lastContentChange;
+        private int m_row;
+        private int m_last = 2;
+
+        FileRevisionsTableModel(File file, PageState state) {
+            m_file = file;
+            m_state = state;
+
+            m_tc = m_file.getRevision();
+            m_row = (int) m_tc.size() + 1;
+            m_last = m_row;
+
+            // separate collection from last content changes
+        }
+
+        public int getColumnCount() {
+            return 5;
+        }
+
+        public Object getElementAt(int columnIndex) {
+            switch (columnIndex) {
+                case 0:
+                    return new BigDecimal(m_row);
+                case 1: {
+                    com.arsdigita.kernel.User user = m_file.getLastModifiedUser();
+                    if (null == user) {
+                        return "Unknown";
+                    } else {
+                        return user.getPersonName().toString();
+                    }
+                }
+                case 2:
+                    if (m_row == 0)
+                        return Utils.DateFormat.format(m_file.getCreationDate());
+                    else
+                        return Utils.DateFormat.format(m_file.getLastModifiedDate());
+                case 3: {
+                    StringBuffer sb = new StringBuffer();
+                    TagCollection tc = m_transaction.getTags();
+                    int counter = 0;
+                    while (tc.next()) {
+                        counter++;
+                        Tag t = tc.getTag();
+                        sb.append(counter + ") " + t.getDescription() + "  ");
+                    }
+                    return sb.toString();
+                }
+                case 4:
+                    return "download";
+                default:
+                    break;
+            }
+            return null;
+        }
+
+        public Object getKeyAt(int columnIndex) {
+            if (columnIndex == 4) {
+                if (m_row == m_last - 1) {
+                    return "current";
+                } else {
+                    return m_transaction.getID();
+                }
+            } else {
+                return m_file.getID() + "." + (m_row);
+            }
+        }
+
+        public boolean nextRow() {
+            m_row--;
+            if (m_tc.next()) {
+                m_transaction = m_tc.getTransaction();
+                return true;
+            } else {
+                m_tc.close();
+                return false;
+            }
+        }
+    }
+}

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileSendColleagueForm.java

@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2001-2004 Red Hat Inc. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+package com.arsdigita.docrepo.ui;
+
+import com.arsdigita.bebop.ColumnPanel;
+import com.arsdigita.bebop.Form;
+import com.arsdigita.bebop.FormData;
+import com.arsdigita.bebop.FormProcessException;
+import com.arsdigita.bebop.Label;
+import com.arsdigita.bebop.PageState;
+import com.arsdigita.bebop.RequestLocal;
+import com.arsdigita.bebop.SimpleContainer;
+import com.arsdigita.bebop.event.FormInitListener;
+import com.arsdigita.bebop.event.FormProcessListener;
+import com.arsdigita.bebop.event.FormSectionEvent;
+import com.arsdigita.bebop.form.Submit;
+import com.arsdigita.bebop.form.TextArea;
+import com.arsdigita.bebop.form.TextField;
+import com.arsdigita.bebop.parameters.NotEmptyValidationListener;
+import com.arsdigita.docrepo.File;
+import com.arsdigita.mail.Mail;
+import com.arsdigita.util.StringUtils;
+import org.apache.log4j.Logger;
+
+import javax.mail.MessagingException;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+//import com.arsdigita.bebop.FormProcessException;
+
+/**
+ * This component allows the user to send the document to
+ * someone by e-mail. The document is enclosed as an attachment
+ * and send using the com.arsdigita.mail package services, this
+ * package is built ontop of javax.mail.
+ *
+ * @see com.arsdigita.mail
+ *
+ * @author <mailto href="StefanDeusch@computer.org">Stefan Deusch</a>
+ * @author <mailto href="ddao@arsdigita.com">David Dao</a>
+ * @author <a href="mailto:tosmers@uni-bremen.de>Tobias Osmers</a>
+ */
+public class FileSendColleagueForm extends Form implements FormProcessListener,
+        FormInitListener, Constants {
+
+    private static final Logger log = Logger.getLogger(
+            FileSendColleagueForm.class);
+
+    private static final char EMAIL_SEPARATOR = ';';
+    private static final String EMAIL_LIST = "emailList";
+    private static final String EMAIL_SUBJECT = "subject";
+    private static final String DESCRIPTION = "description";
+
+    private RequestLocal m_fileData;
+    private TextField m_emailList;
+    private TextField m_subject;
+    private TextArea m_message;
+
+    private FileInfoPropertiesPane m_parent;
+
+    /**
+     * Constructor. Creates the necessary form.
+     *
+     * @param parent The fileInfoPropertiesPane
+     */
+    public FileSendColleagueForm(FileInfoPropertiesPane parent) {
+        super("FileSendColleagueForm", new ColumnPanel(2));
+        m_parent = parent;
+
+        // initialize the file
+        m_fileData = new DocRepoRequestLocal();
+
+        add(SEND_FRIEND_FORM_EMAIL_SUBJECT);
+        m_subject = new TextField(EMAIL_SUBJECT);
+        m_subject.addValidationListener(new NotEmptyValidationListener());
+        add(m_subject);
+
+        add(SEND_FRIEND_FORM_EMAIL_LIST);
+        m_emailList = new TextField(EMAIL_LIST);
+        m_emailList.addValidationListener(new NotEmptyValidationListener());
+        add(m_emailList);
+
+        add(SEND_FRIEND_FORM_DESCRIPTION);
+        m_message = new TextArea(DESCRIPTION);
+        m_message.setRows(10);
+        m_message.setCols(40);
+        add(m_message);
+
+        SimpleContainer sc = new SimpleContainer();
+
+        sc.add(new Submit(SEND_FRIEND_FORM_SUBMIT));
+        CancelButton cancel = new CancelButton(CANCEL);
+        sc.add(cancel);
+
+        add(new Label()); // spacer
+        add(sc, ColumnPanel.LEFT);
+
+        addInitListener(this);
+        addProcessListener(this);
+    }
+
+    /**
+     * Returns a file as the request-specific value for the current state
+     *
+     * @param s The current page state
+     * @return A file
+     */
+    private File getFile(PageState s) {
+        return (File) m_fileData.get(s);
+    }
+
+    /**
+     * Pre-fill the e-mail subject field with file name.
+     *
+     * @param e the FormSectionEvent
+     */
+    public void init(FormSectionEvent e)
+            throws FormProcessException {
+        PageState state = e.getPageState();
+
+        // Todo: fix the Kernel Context
+//        if ( Kernel.getContext().getParty() == null ) {
+//            Util.redirectToLoginPage(state);
+//            return;
+//        }
+
+        FormData data = e.getFormData();
+
+        data.put(EMAIL_SUBJECT, getFile(state).getName());
+    }
+
+
+    /**
+     * No Form validation happens here, the email addresses are parsed
+     * and the file is e-mailed as attachment.
+     *
+     * @param e The FormSectionEvent
+     */
+    public void process(FormSectionEvent e)
+            throws FormProcessException {
+
+        PageState state = e.getPageState();
+        // Todo: not used
+        //FormData data = e.getFormData();
+        //HttpServletRequest req = state.getRequest();
+
+        String emailRecpts = (String) m_emailList.getValue(state);
+        String recipient[] = StringUtils.split(emailRecpts, EMAIL_SEPARATOR);
+        String subject = (String) m_subject.getValue(state);
+
+        // message to go with the doc attachment
+        String message = (String) m_message.getValue(state);
+
+        // Sender e-mail address
+        String from = Utils.getUser(state).getPrimaryEmailAddress()
+                .getAddress();
+
+        File file = getFile(state);
+        String filename = file.getName();
+        String mimeType = file.getContentType();
+        byte[] attachment = getBytes(file);
+
+        for (String aRecipient : recipient) {
+            // TODO validate email of recipient for format
+            sendDocument(aRecipient, from, subject, message, filename,
+                    mimeType, attachment);
+        }
+
+        m_parent.displayPropertiesAndActions(state);
+    }
+
+    /**
+     * Send the document as attachment to one e-mail recipient
+     *
+     * @param recipient The recipient of the mail
+     * @param sender The sender of the mail
+     * @param subject The subject of the mail
+     * @param message The actual message of the mail
+     * @param filename The filename to be send
+     * @param mimeType The mimetype
+     * @param attchmnt The attachment
+     */
+    private static void sendDocument(String recipient,
+                                     String sender,
+                                     String subject,
+                                     String message,
+                                     String filename,
+                                     String mimeType,
+                                     byte[] attchmnt) {
+
+        try {
+            Mail mail =  new Mail(recipient, sender, subject);
+            mail.setBody(message);
+            mail.attach(attchmnt,  mimeType, filename);
+            mail.send();
+        } catch (MessagingException exc) {
+            log.error("Couldn't send the mail.", exc);
+            // Todo: log in some buffer, or schedule for re-try later
+        }
+    }
+
+    /**
+     * Get the bytes from the given document resource
+     *
+     * @param file The document resource
+     * @return A byte array
+     */
+    private static byte[] getBytes(File file) {
+        ByteArrayOutputStream outputStream = null;
+        try {
+            outputStream = new ByteArrayOutputStream();
+            InputStream inputStream = file.getInputStream();
+            byte[] buf = new byte[8192];
+            int sz = 0;
+            while ((sz = inputStream.read(buf, 0, 8192)) != -1) {
+                outputStream.write(buf, 0, sz);
+            }
+        } catch(IOException iox) {
+            iox.printStackTrace();
+        }
+        return outputStream.toByteArray();
+    }
+}

ccm-docrepo/src/main/java/com/arsdigita/docrepo/ui/FileUploadForm.java

@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2001-2004 Red Hat Inc. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+package com.arsdigita.docrepo.ui;
+
+import com.arsdigita.bebop.ColumnPanel;
+import com.arsdigita.bebop.Form;
+import com.arsdigita.bebop.FormData;
+import com.arsdigita.bebop.FormProcessException;
+import com.arsdigita.bebop.Label;
+import com.arsdigita.bebop.PageState;
+import com.arsdigita.bebop.SimpleContainer;
+import com.arsdigita.bebop.Tree;
+import com.arsdigita.bebop.event.FormInitListener;
+import com.arsdigita.bebop.event.FormProcessListener;
+import com.arsdigita.bebop.event.FormSectionEvent;
+import com.arsdigita.bebop.event.FormValidationListener;
+import com.arsdigita.bebop.form.FileUpload;
+import com.arsdigita.bebop.form.Submit;
+import com.arsdigita.bebop.form.TextArea;
+import com.arsdigita.bebop.parameters.StringLengthValidationListener;
+import com.arsdigita.bebop.parameters.StringParameter;
+import com.arsdigita.dispatcher.MultipartHttpServletRequest;
+import com.arsdigita.docrepo.InvalidNameException;
+import com.arsdigita.docrepo.Util;
+import com.arsdigita.util.Assert;
+import com.arsdigita.web.Web;
+import org.apache.log4j.Logger;
+import org.libreccm.cdi.utils.CdiUtil;
+import org.libreccm.docrepo.BlobObject;
+import org.libreccm.docrepo.File;
+import org.libreccm.docrepo.Folder;
+import org.libreccm.docrepo.Resource;
+import org.libreccm.docrepo.ResourceRepository;
+
+import javax.activation.MimeType;
+import javax.servlet.http.HttpServletRequest;
+import java.math.BigDecimal;
+
+/**
+ * Form to upload and submit a file to the document repository.
+ *
+ * @author <mailto href="StefanDeusch@computer.org">Stefan Deusch</a>
+ * @author <a href="mailto:tosmers@uni-bremen.de>Tobias Osmers</a>
+ * @version $Id: FileUploadForm.java  pboy $
+ */
+public class FileUploadForm extends Form implements FormInitListener,
+        FormValidationListener, FormProcessListener, Constants {
+
+    private static final Logger log = Logger.getLogger(FileUploadForm.class);
+
+    // Form constants
+    private final static String FILE_UPLOAD = "file-upload";
+    private final static String FILE_UPLOAD_FORM = "file-upload-form";
+    private final static String FILE_UPLOAD_INPUT_DESCRIPTION = "file-description";
+
+    private FileUpload m_fileUpload;
+
+    private StringParameter m_FileDesc;
+    private Tree m_tree;
+    private BrowsePane m_parent;
+
+    /**
+     * Constructor.
+     *
+     * @param parent The browsePane
+     * @param tree The tree
+     */
+    public FileUploadForm(BrowsePane parent, Tree tree) {
+        this(parent, tree, true);
+    }
+
+    /**
+     * Creates the form for the file upload.
+     *
+     * @param parent The browse pane
+     * @param tree A tree
+     * @param initListeners Weather there are initial listeners or not
+     */
+    public FileUploadForm(BrowsePane parent, Tree tree, boolean initListeners) {
+        super(FILE_UPLOAD_FORM, new ColumnPanel(2));
+
+        m_parent = parent;
+
+        setMethod(Form.POST);
+        setEncType("multipart/form-data");
+
+        m_tree = tree;
+
+        m_fileUpload = new FileUpload(FILE_UPLOAD);
+
+        m_FileDesc = new StringParameter(FILE_UPLOAD_INPUT_DESCRIPTION);
+        m_FileDesc.addParameterListener
+                (new StringLengthValidationListener(4000));
+
+        add(new Label(FILE_UPLOAD_ADD_FILE));
+        add(m_fileUpload);
+
+        add(new Label(FILE_DESCRIPTION));
+        TextArea textArea = new TextArea(m_FileDesc);
+        textArea.setRows(10);
+        textArea.setCols(40);
+        add(textArea);
+
+        SimpleContainer sc = new SimpleContainer();
+        Submit submit = new Submit("submit");
+        submit.setButtonLabel(FILE_SUBMIT);
+        sc.add(submit);
+        CancelButton cancel = new CancelButton(CANCEL);
+        sc.add(cancel);
+
+        add(new Label()); // spacer
+        add(sc, ColumnPanel.LEFT);
+
+        if (initListeners) {
+            addInitListener(this);
+            addProcessListener(this);
+            addValidationListener(this);
+        }
+    }
+
+    /**
+     * Post the file to a temporary file on the server and
+     * insert it into the database
+     *
+     * @param e The form section event
+     */
+    protected Long insertFile(FormSectionEvent e)
+            throws FormProcessException {
+        log.debug("Inserting a file into the database");
+
+        final PageState state = e.getPageState();
+        final FormData data = e.getFormData();
+        final HttpServletRequest req = state.getRequest();
+
+        // stuff for the file
+        final String fileName = getFileName(e);
+        final String fileDescription = (String) data.get(FILE_UPLOAD_INPUT_DESCRIPTION);
+        final String filePath = (String) data.get(FILE_UPLOAD);
+        final MimeType mimeType = Util.guessContentType(fileName, req);
+
+
+        if (log.isDebugEnabled()) {
+            log.debug("getFileName() -> '" + fileName + "'");
+            log.debug("description == '" + fileDescription + "'");
+            log.debug("path == '" + filePath + "'");
+        }
+
+        java.io.File src = null;
+
+        if (filePath != null && filePath.length() > 0) {
+            HttpServletRequest mreq = e.getPageState().getRequest();
+
+            //  Assert.assertTrue(mreq instanceof MultipartHttpServletRequest,
+            Assert.isTrue(mreq instanceof MultipartHttpServletRequest,
+                    "I got a " + mreq + " when I was " +
+                            "expecting a MultipartHttpServletRequest");
+
+            src = ((MultipartHttpServletRequest) mreq).getFile(FILE_UPLOAD);
+            log.debug("file == '" + src + "'");
+        }
+
+        Folder parent = null;
+        String selKey = (String) m_tree.getSelectedKey(state);
+
+        final CdiUtil cdiUtil = new CdiUtil();
+        final ResourceRepository resourceRepository = cdiUtil.findBean(
+                ResourceRepository.class);
+
+        if (selKey == null) {
+            parent = Utils.getRootFolder(state);
+        } else {
+            Long folderID = new Long(selKey);
+
+            final Resource resource = resourceRepository.findById(folderID);
+            parent = resource != null && resource.isFolder()
+                    ? (Folder) resource : null;
+        }
+
+        // insert the file in the database below parent
+        final File file = new File;
+
+        file.setParent(parent);
+        file.setName(fileName);
+        file.setDescription(fileDescription);
+        file.setIsFolder(false);
+        file.setPath(filePath);
+        file.setMimeType(mimeType);
+        file.setContent(new BlobObject().setContent(src));
+
+        // annotate first file upload as initial version
+        file.setDescription(FILE_UPLOAD_INITIAL_TRANSACTION_DESCRIPTION.
+                localize(req).toString());
+
+        //file.applyTag(FILE_UPLOAD_INITIAL_TRANSACTION_DESCRIPTION.
+        //localize(req).toString());
+
+        file.save();
+
+        new KernelExcursion() {
+            protected void excurse() {
+                Party currentParty = Kernel.getContext().getParty();
+                setParty(Kernel.getSystemParty());
+                PermissionService.grantPermission(new PermissionDescriptor(PrivilegeDescriptor.ADMIN,
+                        file,
+                        currentParty));
+                Application app = Web.getWebContext().getApplication();
+                Assert.exists(app, Application.class);
+                PermissionService.setContext(file, app);
+            }}.run();
+
+        return file.getID();
+    }
+
+    public void init(FormSectionEvent e) {
+        PageState state = e.getPageState();
+
+        if ( Kernel.getContext().getParty() == null ) {
+            Util.redirectToLoginPage(state);
+        }
+
+    }
+
+    /**
+     * Post the file to a temporary file on the server and
+     * insert it into the database
+     */
+    public void process(FormSectionEvent e)
+            throws FormProcessException {
+        log.debug("Processing form submission");
+
+        insertFile(e);
+
+        if (m_parent != null) {
+            m_parent.displayFolderContentPanel(e.getPageState());
+        }
+
+    }
+
+    /**
+     * Gets either the file name from the widget
+     * or takes the filename from the upload
+     * widget in this order.
+     */
+    protected String getFileName(FormSectionEvent e) {
+        FormData data = e.getFormData();
+        String filename = (String) data.get(FILE_UPLOAD);
+        return Utils.extractFileName(filename, e.getPageState());
+    }
+
+
+    /**
+     * Verify that the parent folder exists and does not contain any
+     * other files or sub folders with the same name as the file being
+     * uploaded.
+     */
+
+    public void validate(FormSectionEvent e) throws FormProcessException {
+        PageState state = e.getPageState();
+        FormData data = e.getFormData();
+        HttpServletRequest req = state.getRequest();
+
+        String fname = Utils.extractFileName(getFileName(e), state);
+
+        // XXX Not localized as the other errors are.
+        if (fname.length() > 200) {
+            data.addError
+                    (FILE_UPLOAD,
+                            "This filename is too long.  It must be fewer than 200 " +
+                                    "characters.");
+        }
+
+        Folder parent = null;
+        String selKey = (String) m_tree.getSelectedKey(state);
+
+        if (selKey == null) {
+            parent = Utils.getRootFolder(state);
+        } else {
+            BigDecimal folderID = new BigDecimal(selKey);
+            try {
+                parent = new Folder(folderID);
+            } catch(DataObjectNotFoundException nf) {
+                throw new ObjectNotFoundException(FOLDER_PARENTNOTFOUND_ERROR
+                        .localize(req).toString());
+            }
+        }
+
+        try {
+            parent.getResourceID(fname);
+            data.addError(FILE_UPLOAD,
+                    RESOURCE_EXISTS_ERROR
+                            .localize(req).toString());
+        } catch(DataObjectNotFoundException nf) {
+            // ok here
+        } catch(InvalidNameException ex) {
+            data.addError(FILE_UPLOAD,
+                    ex.getMessage());
+        }
+    }
+}

ccm-docrepo/src/main/java/org/libreccm/docrepo/RepositoryRepository.java

@@ -19,6 +19,8 @@
 package org.libreccm.docrepo;
 
 import org.libreccm.auditing.AbstractAuditedEntityRepository;
+import org.libreccm.cdi.utils.CdiUtil;
+import org.libreccm.security.PermissionChecker;
 import org.libreccm.security.User;
 
 import javax.enterprise.context.RequestScoped;
@@ -26,6 +28,7 @@ import javax.inject.Inject;
 import javax.persistence.EntityManager;
 import javax.persistence.TypedQuery;
 import java.util.List;
+import java.util.stream.Collectors;
 
 /**
  * Repository class for retrieving, storing and deleting {@code Repository}s.
@@ -58,6 +61,22 @@ public class RepositoryRepository extends
         return entity.getObjectId() == 0;
     }
 
+    /**
+     * Checks if the current subject has permissions grating him the
+     * privilege to read the requested {@link Repository}(s) and removes the
+     * ones he is not allowed to access.
+     *
+     * @param repositories The requested {@link Resource}s, found in the database
+     * @return A list of {@link Resource}s the subject is allowed to access
+     */
+    private List<Repository> permissionFilter(List<Repository> repositories) {
+        final CdiUtil cdiUtil = new CdiUtil();
+        final PermissionChecker permissionChecker = cdiUtil.findBean(
+                PermissionChecker.class);
+        return repositories.stream().filter(repository -> permissionChecker
+                .isPermitted("read", repository)).collect(Collectors.toList());
+    }
+
     /**
      * Retrieve all {@link Repository}s a given {@link User} ownes.
      *
@@ -70,7 +89,7 @@ public class RepositoryRepository extends
                 "DocRepo.findRepositoriesForOwner", Repository.class);
         query.setParameter("owner", owner);
 
-        return query.getResultList();
+        return permissionFilter(query.getResultList());
     }
 
 }

ccm-docrepo/src/main/java/org/libreccm/docrepo/ResourceRepository.java

@@ -20,14 +20,17 @@ package org.libreccm.docrepo;
 
 
 import org.libreccm.auditing.AbstractAuditedEntityRepository;
+import org.libreccm.cdi.utils.CdiUtil;
+import org.libreccm.security.PermissionChecker;
 import org.libreccm.security.User;
 
 import javax.enterprise.context.RequestScoped;
 import javax.inject.Inject;
 import javax.persistence.EntityManager;
 import javax.persistence.TypedQuery;
-
+import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Collectors;
 
 /**
  * Repository class for retrieving, storing and deleting {@code Resource}s.
@@ -59,6 +62,35 @@ public class ResourceRepository extends AbstractAuditedEntityRepository<Long, Re
         return entity.getObjectId() == 0;
     }
 
+    /**
+     * Checks if the current subject has permissions grating him the
+     * privilege to read the requested {@link Resource}(s) and removes the
+     * ones he is not allowed to access.
+     *
+     * @param resources The requested {@link Resource}s, found in the database
+     * @return A list of {@link Resource}s the subject is allowed to access
+     */
+    private List<Resource> permissionFilter(List<Resource> resources) {
+        final CdiUtil cdiUtil = new CdiUtil();
+        final PermissionChecker permissionChecker = cdiUtil.findBean(
+                PermissionChecker.class);
+        return resources.stream().filter(resource -> permissionChecker
+                .isPermitted("read", resource)).collect(Collectors.toList());
+    }
+
+    /**
+     * Checks if the current subject has permissions grating him the
+     * privilege to read the one requested {@link Resource} and removes it if
+     * he is not allowed to access.
+     *
+     * @param resource The requested {@link Resource}, found in the database
+     * @return A list of at most one {@link Resource} the subject is allowed to
+     * access
+     */
+    private Resource permissionFilter(Resource resource) {
+        return permissionFilter(Arrays.asList(resource)).get(0);
+    }
+
     /**
      * Retrieve a {@code Resource} by its {@code path}.
      *
@@ -72,12 +104,7 @@ public class ResourceRepository extends AbstractAuditedEntityRepository<Long, Re
                 "DocRepo.findResourceByPath", Resource.class);
         query.setParameter("pathName", pathName);
 
-        final List<Resource> result = query.getResultList();
-
-        //Check if the result list is empty and if not return the first
-        //element. If their is a result than there can only be one because
-        //the path column of resource has a unique constraint.
-        return result.isEmpty() ? null : result.get(0);
+        return permissionFilter(query.getSingleResult());
     }
 
     /**
@@ -93,7 +120,7 @@ public class ResourceRepository extends AbstractAuditedEntityRepository<Long, Re
                 "DocRepo.findCreatedResourcesFromUser", Resource.class);
         query.setParameter("user", creator);
 
-        return query.getResultList();
+        return permissionFilter(query.getResultList());
     }
 
     /**
@@ -109,7 +136,7 @@ public class ResourceRepository extends AbstractAuditedEntityRepository<Long, Re
                 "DocRepo.findModifiedResourcesFromUser", Resource.class);
         query.setParameter("user", modifier);
 
-        return query.getResultList();
+        return permissionFilter(query.getResultList());
     }
 
     /**
@@ -124,6 +151,6 @@ public class ResourceRepository extends AbstractAuditedEntityRepository<Long, Re
                 "DocRepo.findResourcesByName", Resource.class);
         query.setParameter("name", name);
 
-        return query.getResultList();
+        return permissionFilter(query.getResultList());
     }
 }