as reported in http://drupal.org/node/100906 it seems that a few people have taken to posting .mp3 files attached to issues. :(

sorted by date, they are:

-rw-rw-r--  1 dries  apache  769318 Aug 25  2005 VomiT-Souless.mp3
-rw-r--r--  1 apache apache   28001 Mar 22  2006 test.mp3
-rw-rw-r--  1 apache apache 1682786 Apr 13  2006 01 Ode.mp3
-rw-rw-r--  1 apache apache   51752 Jun 24 08:40 eemaan_ibn_baz.mp3
-rw-rw-r--  1 apache apache  866609 Jul  2 11:27 FirstOfMay.mp3

for now, i moved all of them to /var/www/drupal.org/tmp-files.

what else should we do about this? sadly, there's not yet a setting to limit what file extensions can be attached to issues (i know, there should be... but i'm only human and there's only so much i can do). ;)

anything else to be done in the meantime? (cron job to check the files/issues dir for *.mp3, etc?)

or should this just move immediately to project_issue.module's queue, instead? ;)

thanks,
-derek

CommentFileSizeAuthor
#1 File-uploads_Drupal-50.png17.75 KBsun

Comments

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Component: web site » Spam
StatusFileSize
new File-uploads_Drupal-50.png17.75 KB

Doesn't D.org use the usual upload.module for attachments? It supports file type limitation based on file extensions.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

Yes, but not project module. Project module was built in the dark ages and does its own attachment handling.

heine’s picture

heine commented

Project Issue implements per role whitelists and non-terminal extension munging since about 5 days (DRUPAL-SA-2007-004), so this shouldn't be a problem in the future.

We'll need to take a look in the issues directory once more and delete remaining junk, then this issue can be closed.

dww’s picture

dww
we/he/they
commented

although, in theory, desperate folks could still post .mp3s, which get converted to .mp3.txt, then they could share that link and folks would just have to save the downloaded file and rename it... certainly more of a pain, so much less likely to be abused, but still a little troublesome. *shrug*

Gurpartap Singh’s picture

Gurpartap Singh commented

Has #5 task been done? Good to close this issue now that we restrict issue attachment types?

WorldFallz’s picture

WorldFallz commented
Status: Active » Fixed

Cleaning up the queue. Reopen if this is still a problem.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.