46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
* Limits to size of files that can be uploaded. Prevent someone
|
|
spamming the wiki with CD isos..
|
|
|
|
> CGI.pm has a limitation that you can't prevent someone uploading
|
|
> something huge and filling up your server.
|
|
> However it is obviously possible to not actually put it in to the
|
|
> wiki if it's too large.
|
|
> Presumably there is also a way to limit the size of POST requests
|
|
> in the server.
|
|
|
|
* Limits to the type of files that can be uploaded. To prevent uploads of
|
|
virii, css, raw html etc, and avoid file types that are not safe.
|
|
Should default to excluding all files types, or at least all except
|
|
a very limited set, and should be able to open it up to more types.
|
|
|
|
Would checking for file extensions (.gif, .jpg) etc be enough? Some
|
|
browsers are probably too smart for their own good and may ignore
|
|
the extension / mime info and process as the actual detected file
|
|
type. It may be necessary to use file to determine a file's true type.
|
|
|
|
> I think using the extension is too risky, and as much information as
|
|
> possible should go in to the decision. Saving the file to disk, then
|
|
> checking the type before using it seems like the best approach to me,
|
|
> as long as the file is deleted properly.
|
|
|
|
> Have you any thoughts on what the interface should be? I can see three
|
|
> options. First add a box to the file creation page that allows you
|
|
> to upload a file instead of the page. The second is an upload file
|
|
> link that asks for a page. The last would be an attachments system
|
|
> that e.g. Twiki use, where the file could be uploaded as a subpage.
|
|
|
|
> How about the limit setting etc.? Add it as a box on the admin's
|
|
> preference page, allow it anywhere using preprocessor directives,
|
|
> or have a configuration page that only the admin is allowed to edit
|
|
> (and perhaps people named on the page?)
|
|
|
|
> The syntax of the conditionals isn't too hard, as the things that
|
|
> are being added fit in nicely. It might be nice to allow plugins
|
|
> to register new functions for them, and provide callbacks to
|
|
> provide a yes no answer. I'm haven't looked at the code yet,
|
|
> are the pagespecs uniform in all places, or is the conditional
|
|
> usage an extended one? i.e. can I lock pages based on date etc?
|
|
> --[[JamesWestby]]
|
|
|
|
|