Page 1 of 1
Allowed attachment file extensions
Posted: Tue Aug 20, 2024 5:48 pm
by Octocontrabass
At some point (probably during the upgrade) it seems like the list of allowed file extensions for attachments was changed. The current list of allowed file extensions is...
interesting, but It's easy enough to rename files to one of the allowed extensions before uploading.
It turns out, though, you also can't download attachments with forbidden extensions.
Here's a random example I stumbled across.
I don't know if changing the list of allowed file extensions would be worth the effort, but I figured I'd point it out anyway.
Re: Allowed attachment file extensions
Posted: Wed Aug 21, 2024 8:37 pm
by eekee
It let me download that without warning or error. No idea why.
Re: Allowed attachment file extensions
Posted: Wed Aug 21, 2024 9:23 pm
by Octocontrabass
eekee wrote: ↑Wed Aug 21, 2024 8:37 pmIt let me download that without warning or error.
All three files?
Re: Allowed attachment file extensions
Posted: Wed Aug 21, 2024 9:45 pm
by nullplan
I can confirm that the ld and asm files are now hidden. Honestly, not sure what an extension filter is supposed to do if you can still upload all files by just renaming them.
Re: Allowed attachment file extensions
Posted: Thu Aug 22, 2024 3:30 am
by eekee
Octocontrabass wrote: ↑Wed Aug 21, 2024 9:23 pm
eekee wrote: ↑Wed Aug 21, 2024 8:37 pmIt let me download that without warning or error.
All three files?
Derp! Sorry, no; ld and asm are blocked without even a link.
nullplan wrote: ↑Wed Aug 21, 2024 9:45 pm
I can confirm that the ld and asm files are now hidden. Honestly, not sure what an extension filter is supposed to do if you can still upload all files by just renaming them.
It's certainly close to just being security theater, but not entirely there. I think it's good for boards with non-technical users, particularly
new non-technical users. Do we gain anything from it at all?
Re: Allowed attachment file extensions
Posted: Fri Aug 23, 2024 10:20 am
by chase
I've added ld and asm to the allowed list.