Closed (fixed)
Project:
Audio Recorder Widget
Version:
1.0.0-beta1
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
4 Apr 2021 at 19:48 UTC
Updated:
26 Apr 2021 at 17:24 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
ytsurkHere a first patch.
Comment #3
ytsurkComment #5
adamfranco commentedThanks for the patch. I've included this in 1.0-beta2.
Comment #6
ytsurkThank you for letting this in. When we start promoting this at webform, we might get a lot of installs ;)
First we should to some readiness tasks. Like I said, I'm glad to help, but not right now ...
What do you think about this exposure of the element after the upload ("File upload preview"), this offers itself to be reused by the fieldwidget ..
Comment #7
adamfranco commentedI'm not quite sure I understand your question:
Do you mean: Is the preview a security issue?
The preview provided by the audiorecorder module after the recording is completed is all in the browser using data-URLs -- no data has yet been sent to the server yet and so it is private to the current browser window. It has just been injected into the form as hidden elements via javascript.
js/recorder.js lines 73-84:
Then...
js/recorder.js lines 7-15:
And here is the [dynamic] markup of the field in the browser after recording, before submitting:
Note the
blob:....URL for the<audio srcelement -- it is loading out of the browser's working data rather than loading from the server.Comment #8
ytsurkThank you for the quick response, and detailed clarification of the recording process, haven't gone so far yet, and thought it was already stored on the server.
But actually it's not what I meant, I thought of letting a site builder choose how the uploaded "blob" shall be presented,
in a player, as downloadable file, just as text, as I have seen in the webform module. This makes only partially sense, as the file resides as blob in the browser, nor webform's code can be reused. So I would stick with the HTML5 audioplayer only for now.
Regarding security, it's all up to the site builders. If a webform or entity form is exposed to anonymous users, they could fill the disk of the server, or even use the servers disk to store they're audio (if a public:// file-system is used).
We maybe should add a note about this on the project page, so, that we recommend to use a private file system, when exposing to anon users - and also that exposing the audiorecorder to anon users is an open door for denial of service attacks.
Comment #9
ytsurkAh - and also add a note on the project page, that this module supports webform ;)
Comment #10
adamfranco commentedI've added this note on the project page about webform support.
As the Webform "Audio recorder" element doesn't introduce any security or file-visibility issues beyond those that are already present for any type of file-upload form submission, I'd rather not devote a lot of project-page text to the intricacies of that use case. I'd be happy to add more notes to the README though if you'd like to take a stab at drafting something.