Insecure CSV upload #20

New issue

Closed

opened 2021-04-03 22:59:47 +02:00 by nik · 5 comments

nik commented 2021-04-03 22:59:47 +02:00

Owner

Copy link

CSV fiels are uploaded to the default media storage without any authentication.

Filenames are replaced with a random UUID, but that is not enoughto protect such sensitive information.

CSV fiels are uploaded to the default media storage without any authentication. Filenames are replaced with a random UUID, but that is not enoughto protect such sensitive information.

nik commented 2021-04-05 12:07:11 +02:00

Author

Owner

Copy link

changed due date to April 15, 2021

changed due date to April 15, 2021

nik commented 2021-05-15 19:03:18 +02:00

Author

Owner

Copy link

made the issue visible to everyone

made the issue visible to everyone

hansegucker commented 2021-05-18 16:42:20 +02:00

Owner

Copy link

created merge request !115 to address this issue

created merge request !115 to address this issue

hansegucker commented 2021-05-18 16:42:20 +02:00

Owner

Copy link

mentioned in merge request !115

mentioned in merge request !115

nik commented 2021-05-18 22:39:38 +02:00

Author

Owner

Copy link

assigned to @hansegucker

assigned to @hansegucker

nik closed this issue 2021-05-20 13:05:46 +02:00

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

weblate

renovate/numpy-2.x

renovate/pandas-3.x

check/update-builddeps-package-json

66-adapt-to-places

62-add-generic-default-template-for-room

improved-and-export

csv-export

stable/3.0

release/2.0

feature/more-generic-field-types

feature/general-csv-importer

6.0.0

5.0.0

5.0.0b0

4.0.0.post1

4.0.0.post0

4.0.0

3.0.2

3.0.1

3.0

3.0b0

2.3.1

2.3

2.2.1

2.2

2.1

2.0.post0

2.0

2.0rc2

2.0rc1

2.0b1

2.0b0

1.0a3

1.0a2

1.0a1

1.0a0

Labels

Clear labels   

Security

  

TeX

Needs LaTeX template

  

auto-update

  

board

done

  

board

ready

  

board

todo

  

check

delete-eslint-rc-js

  

check

update-builddeps-package-json

  

check

update-eslint-rc-js

  

check

update-gitignore

  

check

update-merge-request-template

  

check

update-prettier-ignore

  

check

update-pyproject-toml

  

check

update-renovate-json

  

check

update-tox-ini

  

part

backend

Backend (view code, models, logic, etc.)

  

part

ci

  

part

docs

Issue or addition to the documentation

  

part

frontend

Frontend (templates, etc.)

  

part

i18n

Translation or internationalisation issue

  

part

non-technical

Non-technical (policy, maintenance, etc.) issue or discussion

  

part

packaging

Issue concerning the packaging of AlekSIS and components

  

prio

1

Priority High

  

prio

2

Priority Medium

  

prio

3

Priority Low

  

release-mr-5.x

  

size

large

  

size

medium

  

size

small

  

source

customer

Requested by a customer or affiliated user

  

source

customer::fsmw

  

source

customer::fss

  

source

customer::teckids

  

source

downstream

Issue or merge request from other projects using AlekSIS or parts of it

  

type

breaking

  

type

bug

Bug

  

type

feature

New feature

  

type

refactoring

  

workflow

blocked

Issue is blocked by another issue

  

workflow

confirmed

The bug is reproducible and will be fixed

  

workflow

current-todo

  

workflow

discussing

Needs to be discussed before implementation

  

workflow

new-app

Requires new AlekSIS app, which has to be created

  

workflow

wontfix

The bug is not reproducible or the feature was decided against

  

source::aleksolotl

No labels

Security

TeX

auto-update

board

done

board

ready

board

todo

check

delete-eslint-rc-js

check

update-builddeps-package-json

check

update-eslint-rc-js

check

update-gitignore

check

update-merge-request-template

check

update-prettier-ignore

check

update-pyproject-toml

check

update-renovate-json

check

update-tox-ini

part

backend

part

ci

part

docs

part

frontend

part

i18n

part

non-technical

part

packaging

prio

1

prio

2

prio

3

release-mr-5.x

size

large

size

medium

size

small

source

customer

source

customer::fsmw

source

customer::fss

source

customer::teckids

source

downstream

type

breaking

type

bug

type

feature

type

refactoring

workflow

blocked

workflow

confirmed

workflow

current-todo

workflow

discussing

workflow

new-app

workflow

wontfix

source::aleksolotl

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

hansegucker

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

aleksis/AlekSIS-App-CSVImport#20

No description provided.