2008-07-01 04:58:33 +02:00
|
|
|
[[template id=plugin name=conditional core=1 author="[[Joey]]"]]
|
|
|
|
|
[[tag type/useful]]
|
|
|
|
|
|
|
|
|
|
This plugin allows files to be uploaded to the wiki over the web.
|
|
|
|
|
|
|
|
|
|
For each page `foo`, files in the subdirectory `foo/` are treated as
|
|
|
|
|
attachments of that page. Attachments can be uploaded and managed as
|
|
|
|
|
part of the interface for editing a page.
|
|
|
|
|
|
|
|
|
|
Warning: Do not enable this plugin on publically editable wikis, unless you
|
|
|
|
|
take care to lock down the types and sizes of files that can be uploaded.
|
|
|
|
|
Bear in mind that if you let anyone upload a particular kind of file
|
|
|
|
|
("*.mp3" files, say), then someone can abuse your wiki in at least three ways:
|
|
|
|
|
|
|
|
|
|
1. By uploading many mp3 files, wasting your disk space.
|
|
|
|
|
2. By uploading mp3 files that attempt to exploit security holes
|
|
|
|
|
in web browsers or other players.
|
|
|
|
|
3. By uploading files that claim to be mp3 files, but are really some
|
|
|
|
|
other kind of file. Some web browsers may display a `foo.mp3` that
|
|
|
|
|
contains html as a web page; including running any malicious javascript
|
|
|
|
|
embedded in that page.
|
|
|
|
|
|
2008-07-03 00:07:34 +02:00
|
|
|
If you enable this plugin, be sure to lock that down, by entering an
|
|
|
|
|
[[enhanced_PageSpec|ikiwiki/pagespec/attachment]] in the "Allowed
|
2008-07-03 00:04:14 +02:00
|
|
|
Attachments" field of the wiki admin's preferences page.
|
2008-07-01 04:58:33 +02:00
|
|
|
|
2008-07-03 00:04:14 +02:00
|
|
|
This plugin will use the [[cpan File::MimeInfo::Magic]] perl module, if
|
|
|
|
|
available, for mimetype checking.
|
