Issue #2 open

Easy removal of uploads module

Dan Jacob avatarDan Jacob created an issue

In many cases it's undesirable to have an automatically registered module that accesses your file uploads directly (for example, the uploads should only be available to selected users). While this could be removed in e.g. nginx configuration, it's easy to forget to do so creating a potential security risk.

Therefore the _uploads module that is added automatically should be easily removable - this could be an argument to configure_uploads or a config setting, e.g. REGISTER_UPLOADS_MODULE.

Comments (2)

  1. Matthew Frazier
    • changed status to open

    I will add code that will prevent the uploads module from being registered if no sets actually need it.

    I am not inclined to allow removing the uploads explicitly, though, because if the module is needed and not provided, then it breaks the UploadSet.url method. Also, application-level upload security that relied on the application serving the uploads itself would break if an external URL was provided to serve the uploads from, as is recommended during production.

    I may add an option that lets you mark a set as "nonserved," which would prevent URLs for the set from being configured or generated, and a send_upload function that wraps like send_static_file. (In that case, it would be recommended to use a server with X-Sendfile support.) The application could then restrict access to the uploads, but configuring an external server would be application-specific. Would that work for your usecase?

  2. Log in to comment
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.