How do I secure file upload in Play! Framework (Scala)

Question

I have implemented a Secured trait as described in the tutorial:

trait Secured {
...

def IsAuthenticated(f: => String => Request[AnyContent] => Result) = Security.Authenticated(username, onUnauthorized) { user =>
    Action(request => f(user)(request))
  }
...
}

And using it like this:

def list = IsAuthenticated { username => _ =>
...
}

Now, I have the following definition for file uploads:

def upload = Action(parse.multipartFormData) { request =>
...
}

Is it possible to combine IsAuthenticated and parse.multipartFormData so I am able to check the user during the file upload?

Answer 1

The version you implemented doesn't receive a BodyParser. In the tutorial there is a version that accepts BodyParsers:

def Authenticated[A](p: BodyParser[A])(f: AuthenticatedRequest[A] => Result) = {
  Action(p) { request =>
    request.session.get("user").flatMap(u => User.find(u)).map { user =>
      f(AuthenticatedRequest(user, request))
    }.getOrElse(Unauthorized)      
  }
}

Use this one. All the code you need is at the bottom of the page .

Answer 2

You may have to overload the function.

   def IsAuthenticated[A](p: BodyParser[A])(f: => String => Request[A] => Result): Action[A] ={
    ...
   }

    def IsAuthenticated[AnyContent](f: => String => Request[AnyContent] => Result): Action[AnyContent] = 
       IsAuthenticated(BodyParsers.parse.anyContent)(f)

I've done something similar in my application.