Browse Source
I, also, replaced some 'logged-in' permission checks to 'administrator' in several defroutes (mostly 'danger-zone' routes). This is the back-end functionality which allows users to upload Snapshots (in .zip files) to the /snapshot directory. The route accepts multi-file uploads and ignores files which are not either a .zip file or if a file has the same name as one of the Snapshots already in the /snapshots directory. Technically, the user can upload several files at once which are not .zip files and the alert-message will relay a 'success' message, even when nothing was added to the system. This is because the system is relaying the upload went without errors and not how valid each file was. The system doesn't have anything built-in which allows the multi-faceted alert-message approach to work. Another thing to note here is the lack of checks for the contents within a .zip Snapshot file. Basically, there isn't any. I am unsure how many moving parts are going to be in these Snapshots in the future and hard-coding checks for directories and file names seems a bit premature (maybe unpredictable?). The HTML template responsible for dealing with the front-end of the Snapshot features clearly state it is a 'danger zone' section of the site. So, there is an expectation (hopefully) of 'if you don't know what you're doing, then don't touch it'. Hello, person of the future. I was really wrong with that assumption, wasn't I?stable
1 changed files with 36 additions and 2 deletions
Loading…
Reference in new issue