Java HTTP状态405-请求方法'；邮政'；文件上载时不支持

在我的spring应用程序中，通过JSP页面上载文件时出现“HTTP Status 405-Request method”POST“not supported”错误。但是已经保存在DB中的记录在JSP页面上列出得非常完美。我在应用程序中使用了spring安全性，没有应用spring安全性，它可以正常工作。为什么在应用spring安全性后它不起作用

我的spring-servlet.xml是：

    <beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"  
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
    http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">

    <!-- It register the beans in context and scan the annotations inside beans and activate them -->
    <context:component-scan base-package="mgr" />


   <bean id="viewResolver"
        class="org.springframework.web.servlet.view.UrlBasedViewResolver">
        <property name="viewClass">
            <value>
                org.springframework.web.servlet.view.tiles2.TilesView
            </value>
        </property>
    </bean>
    <bean id="tilesConfigurer"
        class="org.springframework.web.servlet.view.tiles2.TilesConfigurer">
        <property name="definitions">
            <list>
                <value>/WEB-INF/tiles.xml</value>
            </list>
        </property>
    </bean>

    <!-- This allow for dispatching requests to Controllers -->
    <mvc:annotation-driven />
    <mvc:resources mapping="/js/**" location="/js/"
        cache-period="31556926" />
    <mvc:resources mapping="/css/**" location="/css/"
        cache-period="31556927" />
     <!-- Handles HTTP GET requests for /resources/** by efficiently serving 
        up static resources in the ${webappRoot}/resources directory -->
    <mvc:resources mapping="/resources/**" location="/resources/" />

    <!-- This helps in mapping the logical view names to directly view files under a certain pre-configured directory -->
    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/views/" />
        <property name="suffix" value=".jsp" />
    </bean> 

    <!-- This resolves messages from resource bundles for different locales -->
    <bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
        <property name="basename" value="messages" />
    </bean>

    <!-- This produces a container-managed EntityManagerFactory;
         rather than application-managed EntityManagerFactory as in case of LocalEntityManagerFactoryBean-->
    <bean id="entityManagerFactoryBean" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
      <property name="dataSource" ref="dataSource" />
      <!-- This makes /META-INF/persistence.xml is no longer necessary -->
      <property name="packagesToScan" value="mgr.model" />
      <!-- JpaVendorAdapter implementation for Hibernate EntityManager.Exposes Hibernate's persistence provider and EntityManager extension interface -->
      <property name="jpaVendorAdapter">
         <bean class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter" />
      </property>
      <property name="jpaProperties">
         <props>
            <prop key="hibernate.hbm2ddl.auto">validate</prop>
            <prop key="hibernate.dialect">org.hibernate.dialect.MySQL5Dialect</prop>
            <prop key="hibernate.connection.SetBigStringTryClob">true</prop>
            <prop key="hibernate.jdbc.batch_size">0</prop>
         </props>
      </property>
   </bean>
   <bean id="multipartResolver"
        class="org.springframework.web.multipart.commons.CommonsMultipartResolver">

        <!-- one of the properties available; the maximum file size in bytes -->
        <property name="maxUploadSize" value="10000000" />
    </bean>
   <!-- Simple implementation of the standard JDBC DataSource interface,
        configuring the plain old JDBC DriverManager via bean properties -->
   <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
      <property name="driverClassName" value="com.mysql.jdbc.Driver" />
      <property name="url" value="jdbc:mysql://localhost:3306/mgr" />
      <property name="username" value="root" />
      <property name="password" value="root" />
   </bean>

    <!-- This transaction manager is appropriate for applications that use a single JPA EntityManagerFactory for transactional data access.
        JTA (usually through JtaTransactionManager) is necessary for accessing multiple transactional resources within the same transaction. -->
    <bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">
      <property name="entityManagerFactory" ref="entityManagerFactoryBean" />
   </bean>


   <!-- responsible for registering the necessary Spring components that power annotation-driven transaction management;
        such as when @Transactional methods are invoked -->
   <tx:annotation-driven />

</beans>

org.springframework.web.servlet.view.tiles2.TilesView
/WEB-INF/tiles.xml
验证
org.hibernate.dialogue.mysql5dialogue
真的
0

spring-security.xml是：

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <http auto-config="true" use-expressions="true">

        <intercept-url pattern="/addUser**" access="hasRole('View')"/>
        <intercept-url pattern="/addPhoto**" access="hasRole('View')"/>
        <intercept-url pattern="/addCategory**" access="hasRole('Admin')"/>
        <intercept-url pattern="/addRole**" access="hasRole('Admin')"/>
        <intercept-url pattern="/addPrivilege**" access="hasRole('Admin')"/>
        <intercept-url pattern="/index**" access="hasRole('Admin')"/>
        <!-- access denied page -->
        <access-denied-handler error-page="/403" />

        <form-login 
            login-page="/login" 
            default-target-url="/login" 
            authentication-failure-url="/login?error" 
            username-parameter="username"
            password-parameter="password" />
        <logout logout-success-url="/login?logout" />
        <!-- enable csrf protection -->
        <csrf/>
    </http>
<global-method-security pre-post-annotations="enabled"/>
<!-- Select users and user_roles from database -->
    <authentication-manager>
      <authentication-provider>
        <jdbc-user-service data-source-ref="dataSource"
          users-by-username-query=
            "select user_name,password, isActive from mgr_user where user_name=?"
          authorities-by-username-query=
            "select usr.user_name,role.name
             from mgr_user usr
                  join mgr_user_cat_role cr on(cr.ucat_id = usr.ucat_id and cr.isassign = 1)
                  join mgr_user_category cat on(cat.id = cr.ucat_id)
                  join mgr_user_role role on(role.id = cr.urole_id)
             where usr.user_name=?" />
      </authentication-provider>
    </authentication-manager>

</beans:beans>

名称
描述
文件


文件清单
名称
描述
${document.name}
${document.description}

尝试添加

<intercept-url pattern="/savePhoto**" access="hasRole('VIEW')" method="POST"/>

---

我在下面的行中添加了spring security.xml，现在它运行良好

<form:form method="post" action="savePhoto?${_csrf.parameterName}=${_csrf.token}" commandName="document" enctype="multipart/form-data">

即使我没有在其他jsp页面中添加“${u csrf.parameterName}=${{u csrf.token}”，它们也可以正常工作。请解释一下

/**
 * 
 */
package mgr.controller;

import java.io.IOException;
import java.io.OutputStream;
import java.sql.Blob;
import java.sql.SQLException;
import java.util.Map;

import javax.servlet.http.HttpServletResponse;
import javax.sql.rowset.serial.SerialException;

import mgr.dao.DocumentDao;
import mgr.model.Document;

import org.apache.commons.io.IOUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.multipart.MultipartFile;

/**
 * @author Charith
 *
 */
@Controller
public class DocumentController {
    @Autowired
    private DocumentDao documentDao;


    @RequestMapping("/index")
    public String index(Map<String, Object> map) {

        try {
            map.put("document", new Document());
            map.put("documentList", documentDao.list());
        } catch (Exception e) {
            e.printStackTrace();
        }

        return "documents";
    }

    @RequestMapping(value = "/savePhoto", method = RequestMethod.POST)
    public String save(@ModelAttribute("document") Document document,
            @RequestParam("file") MultipartFile file) {

        System.out.println("Name:" + document.getName());
        System.out.println("Desc:" + document.getDescription());
        System.out.println("File:" + file.getName());
        System.out.println("ContentType:" + file.getContentType());

        // Blob blob = Hibernate.createBlob(file.getInputStream());
        Blob blob;
        try {
            blob = new javax.sql.rowset.serial.SerialBlob(
                    IOUtils.toByteArray(file.getInputStream()));
            document.setFilename(file.getOriginalFilename());
            document.setContent(blob);
            document.setContentType(file.getContentType());
        } catch (SerialException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }

        try {
            documentDao.save(document);
        } catch (Exception e) {
            e.printStackTrace();
        }

        return "redirect:/index.html";
    }

    @RequestMapping("/download/{documentId}")
    public String download(@PathVariable("documentId") Integer documentId,
            HttpServletResponse response) {
        System.out.println("documentId"+documentId);
        Document doc = documentDao.get(documentId);
        System.out.println("file name :"+doc.getFilename());
        try {
            response.setHeader("Content-Disposition", "inline;filename=\""
                    + doc.getFilename() + "\"");
            OutputStream out = response.getOutputStream();
            response.setContentType(doc.getContentType());
            IOUtils.copy(doc.getContent().getBinaryStream(), out);
            out.flush();
            out.close();

        } catch (IOException e) {
            e.printStackTrace();
        } catch (SQLException e) {
            e.printStackTrace();
        }

        return null;
    }

    @RequestMapping("/remove/{documentId}")
    public String remove(@PathVariable("documentId") Integer documentId) {

        documentDao.remove(documentId);

        return "redirect:/index.html";
    }
}

<%@taglib uri="http://www.springframework.org/tags" prefix="spring"%>
<%@taglib uri="http://www.springframework.org/tags/form" prefix="form"%>
<%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<html>
<head>
    <title>Document Manager - viralpatel.net</title>
</head>
<body>

<h2>Document Manager</h2>

<h3>Add new document</h3>
 <c:url value="/j_spring_security_logout" var="logoutUrl" />
    <!-- csrt for log out-->
    <form action="${logoutUrl}" method="post" id="logoutForm">
      <input type="hidden" 
        name="${_csrf.parameterName}"
        value="${_csrf.token}" />
    </form>

    <script>
        function formSubmit() {
            document.getElementById("logoutForm").submit();
        }
    </script>

    <c:if test="${pageContext.request.userPrincipal.name != null}">
        <h2>
            Welcome : ${pageContext.request.userPrincipal.name} | <a
                href="javascript:formSubmit()"> Logout</a>
        </h2>
    </c:if>
<form:form method="post" action="savePhoto" commandName="document" enctype="multipart/form-data">
    <form:errors path="*" cssClass="error"/>
    <table>
    <tr>
        <td><form:label path="name">Name</form:label></td>
        <td><form:input path="name" /></td> 
    </tr>
    <tr>
        <td><form:label path="description">Description</form:label></td>
        <td><form:textarea path="description" /></td>
    </tr>
    <tr>
        <td><form:label path="content">Document</form:label></td>
        <td><input type="file" name="file" id="file"></input></td>
    </tr>
    <tr>
        <td colspan="2">
            <input type="submit" value="Add Document"/>
        </td>
    </tr>
</table>  
</form:form>

<br/>
<h3>Document List</h3>
<c:if  test="${!empty documentList}">
<table class="data">
<tr>
    <th>Name</th>
    <th>Description</th>
    <th>&nbsp;</th>
</tr>
<c:forEach items="${documentList}" var="document">
    <tr>
        <td width="100px">${document.name}</td>
        <td width="250px">${document.description}</td>
        <td width="20px">
            <a href="${pageContext.request.contextPath}/download/${document.id}.html"><img
                src="${pageContext.request.contextPath}/img/save_icon.gif" border="0"
                title="Download this document"/></a> 

            <a href="${pageContext.request.contextPath}/remove/${document.id}.html"
                onclick="return confirm('Are you sure you want to delete this document?')"><img
                src="${pageContext.request.contextPath}/img/delete_icon.gif" border="0"
                title="Delete this document"/></a> 
        </td>
    </tr>
</c:forEach>
</table>
</c:if>
</body>
</html>

<intercept-url pattern="/savePhoto**" access="hasRole('VIEW')" method="POST"/>

<form:form method="post" action="savePhoto?${_csrf.parameterName}=${_csrf.token}" commandName="document" enctype="multipart/form-data">