Allowed attachment file extensions

Questions, comments, and suggestions about this site should go here.
Post Reply
Octocontrabass
Member
Member
Posts: 5512
Joined: Mon Mar 25, 2013 7:01 pm

Allowed attachment file extensions

Post by Octocontrabass »

At some point (probably during the upgrade) it seems like the list of allowed file extensions for attachments was changed. The current list of allowed file extensions is... interesting, but It's easy enough to rename files to one of the allowed extensions before uploading.

It turns out, though, you also can't download attachments with forbidden extensions. Here's a random example I stumbled across.

I don't know if changing the list of allowed file extensions would be worth the effort, but I figured I'd point it out anyway.
User avatar
eekee
Member
Member
Posts: 872
Joined: Mon May 22, 2017 5:56 am
Location: Kerbin
Discord: eekee
Contact:

Re: Allowed attachment file extensions

Post by eekee »

Octocontrabass wrote: Tue Aug 20, 2024 5:48 pm It turns out, though, you also can't download attachments with forbidden extensions. Here's a random example I stumbled across.
It let me download that without warning or error. No idea why.
Kaph — a modular OS intended to be easy and fun to administer and code for.
"May wisdom, fun, and the greater good shine forth in all your work." — Leo Brodie
Octocontrabass
Member
Member
Posts: 5512
Joined: Mon Mar 25, 2013 7:01 pm

Re: Allowed attachment file extensions

Post by Octocontrabass »

eekee wrote: Wed Aug 21, 2024 8:37 pmIt let me download that without warning or error.
All three files?
nullplan
Member
Member
Posts: 1766
Joined: Wed Aug 30, 2017 8:24 am

Re: Allowed attachment file extensions

Post by nullplan »

I can confirm that the ld and asm files are now hidden. Honestly, not sure what an extension filter is supposed to do if you can still upload all files by just renaming them.
Carpe diem!
User avatar
eekee
Member
Member
Posts: 872
Joined: Mon May 22, 2017 5:56 am
Location: Kerbin
Discord: eekee
Contact:

Re: Allowed attachment file extensions

Post by eekee »

Octocontrabass wrote: Wed Aug 21, 2024 9:23 pm
eekee wrote: Wed Aug 21, 2024 8:37 pmIt let me download that without warning or error.
All three files?
Derp! Sorry, no; ld and asm are blocked without even a link.
nullplan wrote: Wed Aug 21, 2024 9:45 pm I can confirm that the ld and asm files are now hidden. Honestly, not sure what an extension filter is supposed to do if you can still upload all files by just renaming them.
It's certainly close to just being security theater, but not entirely there. I think it's good for boards with non-technical users, particularly new non-technical users. Do we gain anything from it at all?
Kaph — a modular OS intended to be easy and fun to administer and code for.
"May wisdom, fun, and the greater good shine forth in all your work." — Leo Brodie
User avatar
chase
Site Admin
Posts: 710
Joined: Wed Oct 20, 2004 10:46 pm
Libera.chat IRC: chase_osdev
Location: Texas
Discord: chase/matt.heimer
Contact:

Re: Allowed attachment file extensions

Post by chase »

I've added ld and asm to the allowed list.
Post Reply