Hi!

Today I tested the new version 7.x-3.12 and the new security upgrade makes some changes in the behaviour of services.

I had a special file extension, that is not allowed in the extensions list:

// This whitelist is copied from file_save_upload().
//$extensions = 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp';

and I had to modify the source to upload some files.

I know that it cannot be implemented as the same manner that file_save_upload, that takes care of the valid extensions declared in the field.
When someone is uploading using services, we don't know what is the purpose of the file.

One way to accomplish these is that we can upload a file when creating nodes.
When the service gets the data, check the valid extensions like file_save_upload, and save file, before the node is saved.

Another way is to become valid extensions editable under Administration of Services, or File System.

Or perhaps, a more complex one: select only valid extensions from fields list.

Anyone are agree with this?

Comments

kylebrowning’s picture

kylebrowning commented

Maybe we just add drupal alter method here so you can change it in code. It would be really bad to let admins configure this. I think it should be explicitly done in code to protect people a little bit.

rasikap’s picture

rasikap commented

Please refer https://www.drupal.org/node/2502281#comment-10321753 for the patch. Please review and let me know the feedback.

rasikap’s picture

rasikap commented
Status: Active » Needs review
kylebrowning’s picture

kylebrowning commented

This needs a security review honestly. The whole reason this was added was because its a security issue to be able to upload certain types of files. If we give people the ability to enable these types of files they are at a major security risk.

marcingy’s picture

marcingy commented
Status: Needs review » Closed (duplicate)

Closing as this is a dup of #2502281: Allow more file extensions to be uploaded using create_raw if that patch 'solves' this issue