*) only install files from the RELEASE directory

*) minor changes

htroot/ConfigUpdate_p.java

@@ -119,8 +119,6 @@ public class ConfigUpdate_p {
                         }
                     } catch (final NullPointerException e) {
                         sb.getLog().logSevere("AUTO-UPDATE: could not delete release " + release + ": " + e.getMessage());
-                    } catch (final IOException e) {
-                        sb.getLog().logSevere("AUTO-UPDATE: could not delete release " + release + ": " + e.getMessage());
                     }
                 }
             }

htroot/Steering.html

@@ -197,7 +197,7 @@ pVSsUqnIYrFYnpycnJmYmJiQUg4LIU4bhtGfyWQOd3V1nRwfH7d27Ngh4fzerMQl+nWChbEwFsbC
 WBgLY2EsjIWxMBbG6z7+PzoY5xKR42VVAAAAAElFTkSuQmCC" width="100" height="100" alt="Kaskelix"/></p>
       #(info)#
       <p><b>No action submitted</b><br />
-      Go back to the <a href="Settings_p.html">Settings</a> page</p>
+      Go back to the <a href="Settings_p.html">Settings</a> page.</p>
 ::
       <p><b>Your system is not protected by a password</b><br />
       Please go to the <a href="/ConfigAccounts_p.html">User Administration</a> page and set an administration password.</p>
@@ -221,6 +221,9 @@ WBgLY2EsjIWxMBbG6z7+PzoY5xKR42VVAAAAAElFTkSuQmCC" width="100" height="100" alt="
       YaCy will be restarted after installation.</p>
       <script type="text/javascript">window.setTimeout('setPingInterval()', 10000);</script>
       <div id="status"></div>
-      #(/info)#
+::
+      <p><b>The file you are trying to install is not located in the release directory.<br />
+      Go back to the <a href="ConfigUpdate_p.html">System Update</a> page.</p>
+#(/info)#
   </body>
 </html>

htroot/Steering.java

@@ -33,6 +33,7 @@ import net.yacy.cora.protocol.Domains;
 import net.yacy.cora.protocol.HeaderFramework;
 import net.yacy.cora.protocol.RequestHeader;
 import net.yacy.kelondro.logging.Log;
+import net.yacy.kelondro.util.FileUtils;
 import net.yacy.peers.operation.yacyRelease;
 import net.yacy.search.Switchboard;
 import net.yacy.server.serverObjects;
@@ -76,12 +77,16 @@ public class Steering {
             Log.logInfo("STEERING", "update request from " + requestIP);
             final boolean devenvironment = new File(sb.getAppPath(), ".git").exists();
             final String releaseFileName = post.get("releaseinstall", "");
-            final File releaseFile = new File(sb.getDataPath(), "DATA/RELEASE/".replace("/", File.separator) + releaseFileName);
-            if ((!devenvironment) && (releaseFileName.length() > 0) && (releaseFile.exists())) {
-                yacyRelease.deployRelease(releaseFile);
+            final File releaseFile = new File(sb.releasePath, releaseFileName);
+            if (FileUtils.isInDirectory(releaseFile, sb.releasePath)) {
+                if ((!devenvironment) && (releaseFileName.length() > 0) && (releaseFile.exists())) {
+                    yacyRelease.deployRelease(releaseFile);
+                }
+                prop.put("info", "5");
+                prop.putHTML("info_release", releaseFileName);
+            } else {
+                prop.put("info", "6");
             }
-            prop.put("info", "5");
-            prop.putHTML("info_release", releaseFileName);
 
             return prop;
         }

source/net/yacy/kelondro/util/FileUtils.java

@@ -856,17 +856,25 @@ public final class FileUtils {
      * Checks if a certain file is in a given directory.
      * @param file the file to check
      * @param directory the directory which must contain the file
-     * @return true if file is contained in diretory
+     * @return true if file is contained in directory
      */
-    public static boolean isInDirectory(final File file, final File directory) throws IOException {
+    public static boolean isInDirectory(final File file, final File directory) {
         
-        return 
-                directory != null
-                && directory.isDirectory()
-                && file != null
-                && file.isFile()
-                && directory.getCanonicalPath().equalsIgnoreCase(
-                        file.getParentFile().getCanonicalPath());
+        boolean inDirectory;
+        
+        try {
+            inDirectory = (
+                    directory != null
+                    && directory.isDirectory()
+                    && file != null
+                    && file.isFile()
+                    && directory.getCanonicalPath().equalsIgnoreCase(
+                            file.getParentFile().getCanonicalPath()));
+        } catch (IOException e) {
+            inDirectory = false;
+        }
+        
+        return inDirectory;
     }
 
 }