Доступ запрещен ("java.io.FilePermission" "[путь к файлу]" "удалить")

Question

У меня возникла проблема при попытке удалить файлы, загруженные на мой локальный сервер Tomcat 7.

Вот мои загрузки, удалять и checkDelete метода:

PS: UploadedFile класс от структуры Primefaces

private static final String destination=System.getProperty("user.dir")+"\\GED\\documents\\"; 

public static boolean uploadToServer(UploadedFile file) { 

    boolean done = false; 
    try { 

     byte[] bytes; 

     bytes = file.getContents(); 
     String filename = FilenameUtils.getName(file.getFileName()); 
     File dossier = new File(destination); 
     dossier.setExecutable(true,true); 
     dossier.setReadable(true,true); 
     dossier.setWritable(true,true); 

     if(!dossier.exists()) 
      dossier.mkdirs(); 

     if(dossier.exists()) 
     { 
      BufferedOutputStream stream = new BufferedOutputStream(new FileOutputStream(new File(destination+filename))); 
      stream.write(bytes); 
      stream.close(); 

      done = true; 
     } 
    } catch (IOException e) { 
     e.printStackTrace(); 
    } 
    return done; 
} 

public static boolean deleteFromServer(String fileName) { 

    boolean done = false; 

    File f = new File(destination+fileName); 

     if(f.exists() && f.isFile()) 
     { 
      try { 
       done = f.delete(); 

      } catch (SecurityException e) { 
       e.printStackTrace(); 
      } 
     } 
    return done; 
} 

public static boolean checkDelete(String fileName) 
{ 
    SecurityManager manager = new SecurityManager(); 
    try{ 
     manager.checkDelete(destination+fileName); 
    } 
    catch(SecurityException e){ 
     e.printStackTrace(); 
     return false; 
    } 
    return true; 
} 

перед вызовом моего метода deleteFromServer, я вызываю метод checkDelete, чтобы проверить, если у меня есть разрешения перед выполнением удаления, и я получаю следующее сообщение об исключении:

java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\apache-tomcat-7.0.68\bin\GED\documents\file.txt" "delete") 

Я читал об изменении файла catalina.policy, но я действительно не мог понять, как это сделать, и я хочу решение, которое не вызовет никаких проблем с безопасностью на моем сервере.

PS: Мое приложение является JSF веб-приложение

EDIT: полный трассировки стека:

java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\apache-tomcat-7.0.68\bin\GED\documents\pic.jpg" "delete") 
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) 
at java.security.AccessController.checkPermission(AccessController.java:884) 
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) 
at java.lang.SecurityManager.checkDelete(SecurityManager.java:1007) 
at Util.FileManaging.checkDelete(FileManaging.java:71) 
at ServiceImpl.DocumentServiceImpl.delete(DocumentServiceImpl.java:206) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
at java.lang.reflect.Method.invoke(Method.java:498) 
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) 
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281) 
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208) 
at com.sun.proxy.$Proxy177.delete(Unknown Source) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
at java.lang.reflect.Method.invoke(Method.java:498) 
at org.apache.el.parser.AstValue.invoke(AstValue.java:279) 
at org.apache.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:273) 
at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:40) 
at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:50) 
at com.sun.faces.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:105) 
at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:87) 
at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102) 
at javax.faces.component.UICommand.broadcast(UICommand.java:315) 
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:790) 
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:1282) 
at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:81) 
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101) 
at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198) 
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:78) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
at Util.AuthorizationFilter.doFilter(AuthorizationFilter.java:35) 
at org.omnifaces.filter.HttpFilter.doFilter(HttpFilter.java:108) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) 
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) 
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:436) 
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078) 
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625) 
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2517) 
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2506) 
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
at java.lang.Thread.run(Thread.java:745) 

EDIT, вот FilePermission я использую:

java.io.FilePermission "C:/apache-tomcat-7.0.68/bin/GED/documents/-", "delete"; 

Answer 1

Итак, я изменил код метода checkDelete следующим образом:

public static boolean checkDelete(String fileName) 
{ 
    SecurityManager manager = System.getSecurityManager(); //instead of new SecurityManager(); 
    try{ 
     if (manager != null) 
      manager.checkDelete(destination+fileName); 
    } 
    catch(SecurityException e){ 
     e.printStackTrace(); 
     return false; 
    } 
    return true; 
} 

Java Doc: https://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html

Этот метод возвращает истину, и мои размещаемые файлы будут удалены с сервера без необходимости изменять любой файл Catalina.