On allura js/4277. To test, attach both an image and a non-image file to an artifact (should work for tickets, wiki pages, discussion posts, etc the same). Clicking the image should display the image full-size, but clicking the non-image will prompt a download.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
This isn't secure enough. If I upload an HTML attachment and then (directly in mongo) update the content type to text/html/image/ then the attachment will be displayed inline, and Firefox does show it as regular HTML. This is possible since we currently trust user-provided content types.
we should only do inline display of content types that start with image/
we should have a new ticket to not trust user-provided content types at all (the attach() method calls, and mail_tasks.py / handle_message() )
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Actually that is not the problem (although I think it's still safer to do a startswith check). The problem is that self.content_type is used to to the check, but serve() in filesystem.py uses the GridFS fp content_type. We need to check the same value. Offhand, I'm not sure which is best.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
On allura js/4277. To test, attach both an image and a non-image file to an artifact (should work for tickets, wiki pages, discussion posts, etc the same). Clicking the image should display the image full-size, but clicking the non-image will prompt a download.
This isn't secure enough. If I upload an HTML attachment and then (directly in mongo) update the content type to
text/html/image/then the attachment will be displayed inline, and Firefox does show it as regular HTML. This is possible since we currently trust user-provided content types.image/attach()method calls, andmail_tasks.py/handle_message())Actually that is not the problem (although I think it's still safer to do a
startswithcheck). The problem is thatself.content_typeis used to to the check, butserve()infilesystem.pyuses the GridFS fp content_type. We need to check the same value. Offhand, I'm not sure which is best.I made them both use self.content_type.
Here's an example of this.