title: Conditional statements in Spring Controller questions
body: <p>So a have a blueprint code of a web app which allows different accounts with logins to upload simple files. However, there are security flaws that allow non-admin accounts to enter database configurations and direct object referencing (download files of other accounts by URL tampering). I was recommended a solution whereby I check if the owner of the uploaded file is the same one trying to download it. But doing that in a spring @controller posed a few problems. If you look at my get statement to get a specific file, you see that I got the file object and the account object. Then I just check if the name is the same of file owner. But how do I "return" something in a controller while in an "if" statement? </p>
  
  <pre><code>@Controller
  public class FileController {
  
      @Autowired
      private FileRepository fileRepository;
  
      @Autowired
      private AccountRepository accountRepository;
  
      @RequestMapping(value = "/files", method = RequestMethod.GET)
      public String list(Authentication authentication, Model model) {
          model.addAttribute("files", accountRepository.findByUsername(authentication.getName()).getFileObjects());
          return "files";
      }
  
      @RequestMapping(value = "/files/{id}", method = RequestMethod.GET)
      public ResponseEntity&lt;byte[]&gt; viewFile(@PathVariable Long id) {
          //1. get object or name account name
          Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
          String currentPrincipalName = authentication.getName();
          //2. check if the file account is of the same name
          FileObject fo = fileRepository.findOne(id);
          if((fo.getAccount().getUsername()).equals(currentPrincipalName)) {
  
              System.out.println("WHAT AM I SUPPOSED TO DO!?");
  
  
          }
  
  
  
          final HttpHeaders headers = new HttpHeaders();
          headers.setContentType(MediaType.parseMediaType(fo.getContentType()));
          headers.add("Content-Disposition", "attachment; filename=" + fo.getName());
          headers.setContentLength(fo.getContentLength());
  
          return new ResponseEntity&lt;&gt;(fo.getContent(), headers, HttpStatus.CREATED);
      }
  
      @RequestMapping(value = "/files", method = RequestMethod.POST)
      public String addFile(Authentication authentication, @RequestParam("file") MultipartFile file) throws IOException {
          Account account = accountRepository.findByUsername(authentication.getName());
  
  
          FileObject fileObject = new FileObject();
          fileObject.setContentType(file.getContentType());
          fileObject.setContent(file.getBytes());
          fileObject.setName(file.getOriginalFilename());
          fileObject.setContentLength(file.getSize());
          fileObject.setAccount(account);
  
          fileRepository.save(fileObject);
  
  
          return "redirect:/files";
      }
  
      @RequestMapping(value = "/files/{id}", method = RequestMethod.DELETE)
      public String delete(@PathVariable Long id) {
          fileRepository.delete(id);
          return "redirect:/files";
      }
  }
  </code></pre>