[Nms-cgi-devel] Re: [Nms-cgi-support] TFMail: Wrong Filetypes (extensions) are not rejected by the script

[Jonathan S. <jn...@ge...>]

On Tue, 2006-03-28 at 17:16, Cole Bantam wrote:
> Hello there,
> 
> When I read the readme to TFMail, I was pleased, to see the possibility not
> only to upload files to the E-Mail, but to limit the range of file types by
> its extension. But in fact file types other than "allowed" in the
> configfile, are NOT rejected, but only renamed to the last extension that is
> listed.
> 
> Expected behaviour:
> If someone tries to upload a file with an extension that is not listed in
> the configfile, he informed that he was to upload a file type that is not
> supported.
> 
> Existing behaviour:
> If someone uploads a file with an extension, which is not listed in the
> configfile, the attachment is sent with no further comment, but the file
> (extension) is renamed (and so "defect" for many users).
> 
> Does anyone knows how to get the "Expected behaviour"?
> 

You might expect that behaviour but the existing behaviour is the
advertised and designed behaviour.  The problem is that the 'extension'
of the file is not a guarantee of the file type: I could quite easily
rename some random file with a .doc suffix and upload it and the program
would be none the wiser.

Of course it might be nice to have something like this as an option, you
can change the TFmail.pl at line 649 where there is:

         if ( $filename =~ m#\.(\w{1,8})$# and exists $goodext{lc $1} )
         {
            $bestext = $goodext{lc $1};
         }
         elsif ( $ct =~ m#^[\w\-]+/(\w{1,8})$# and exists $goodext{lc $1} )
         {
            $bestext = $goodext{lc $1};
         }

To

         if ( $filename =~ m#\.(\w{1,8})$# and exists $goodext{lc $1} )
         {
            $bestext = $goodext{lc $1};
         }
         elsif ( $ct =~ m#^[\w\-]+/(\w{1,8})$# and exists $goodext{lc $1} )
         {
            $bestext = $goodext{lc $1};
         }
	 elsif ( $treq->config('strict_extension','0') )
         {
	    die "Bad file type";
         }

and then add

   strict_extension: 1

to your .trc file which will do what you want.  I'm not sure if this is
exactly what we would put in a released version, so I am copying the
developers list to see if anyone has a better idea.

/J\
-- 

This e-mail is sponsored by http://www.integration-house.com/