MAKENTNU / web

The website of the student organization MAKE NTNU, built with Django.
https://makentnu.no
MIT License
9 stars 5 forks source link

Add the ability to upload files to events/timeplaces #719

Open elisakiv opened 3 months ago

elisakiv commented 3 months ago

Would make it possible to upload powerpoints for the sewing courses or 3D printing courses.

ddabble commented 3 months ago

Resource files like PowerPoints, 3D models, etc., are often considerably larger than e.g. the banner images we currently allow members to upload (which are also compressed when uploaded), and so it's reasonable to assume that our server's storage space will be depleted at a much higher rate than it currently is 🤔 It might therefore be better to instead encourage members to upload to our Drive, which has virtually unlimited storage 🙂

Also, from a security perspective, allowing uploading and serving arbitrary file types is a little risky 😅 This is of course almost entirely alleviated by the fact that we would only allow uploads from our own trusted members, but there would still be potential for misuse - e.g. something like a member uploading a file (perhaps for fun) that exploits some (perhaps undiscovered) weakness in either the server software or the software of the users downloading it. It's hard to measure the likelihood and severity of that risk - especially when considering how it may change many years down the line - and so I personally don't think it's worth the risk 🤔 It would help, of course, if we only allowed certain specific file types to be uploaded, though :)

Did the person who requested this provide any additional context or reasoning, or would it mainly be a "nice-to-have" feature?