64 lines
2.5 KiB
Markdown
64 lines
2.5 KiB
Markdown
(I've written a [[proposal|todo/fileupload/soc-proposal]] for this feature --Ben).
|
|
|
|
Support for uploading files is useful for many circumstances:
|
|
|
|
* Uploading images.
|
|
* Uploading local.css files (admin only).
|
|
* Uploading mp3s for podcasts.
|
|
* Etc.
|
|
|
|
ikiwiki should have an easy to use interface for this, but the real meat of
|
|
the work is in securing it. Several classes of controls seem appropriate:
|
|
|
|
* Limits to size of files that can be uploaded. Prevent someone spamming
|
|
the wiki with CD isos..
|
|
* Limits to the type of files that can be uploaded. To prevent uploads of
|
|
virii, css, raw html etc, and avoid file types that are not safe.
|
|
Should default to excluding all files types, or at least all
|
|
except a very limited set, and should be able to open it up to more
|
|
types.
|
|
|
|
Would checking for file extensions (.gif, .jpg) etc be enough? Some
|
|
browsers are probably too smart for their own good and may ignore the
|
|
extension / mime info and process as the actual detected file type. It
|
|
may be necessary to use `file` to determine a file's true type.
|
|
* Optional ability to test a file using a virus scanner like clamav.
|
|
* Limits to who can upload what type of files.
|
|
* Limits to what files can be uploaded where.
|
|
|
|
It seems that for max flexability, rules should be configurable by the admin
|
|
to combine these limits in different ways. If we again extend the pagespec
|
|
for this, as was done for [[conditional_text_based_on_ikiwiki_features]],
|
|
the rules might look something like this:
|
|
|
|
( maxsize(30kb) and type(webimage) ) or
|
|
( user(joey) and maxsize(1mb) and (type(webimage) or *.mp3) ) or
|
|
( user(joey) and maxsize(200mb) and (*.mov or *.avi) and videos/*)
|
|
|
|
With a small extension, this could even be used to limit the max sizes of
|
|
normal wiki pages, which could be useful if someone was abusing an open wiki
|
|
as a wikifs. Maybe.
|
|
|
|
( type(page) and maxsize(32k) )
|
|
|
|
And if that's done, it can also be used to lock users from editing a pages
|
|
or the whole wiki:
|
|
|
|
!(( user(spammer) and * ) or
|
|
( user(42.12.*) and * ) or
|
|
( user(http://evilopenidserver/*) and * ) or
|
|
( user(annoying) and index) or
|
|
( immutable_page ))
|
|
|
|
That would obsolete the current simple admin prefs for banned users and
|
|
locked pages. Suddenly all the access controls live in one place.
|
|
Wonderbar!
|
|
|
|
(Note that pagespec_match will now return an object that stringifies to a
|
|
message indicating why the pagespec matched, or failed to match, so if a
|
|
pagespec lock like the above prevents an edit or upload from happening,
|
|
ikiwiki could display a reasonable message to the user, indicating what
|
|
they've done wrong.)
|
|
|
|
[[tag soc]]
|