search

Netsach / concrete-datastore

A Highly Versatile REST Datastore built on top of Django
https://concrete-datastore.com
GNU General Public License v3.0
34 stars 17 forks source link

Add SVG file management to concrete #86

Open SachaBrd opened 3 years ago

SachaBrd commented 3 years ago

any .svg image is currently not managed by concrete-datastore . .svg is an xml image format, and should be considered as an image field, currently, it is only recongized as a type file, so we have to overload image field in concrete in order to add .svgfiles

SachaBrd commented 3 years ago

Adding an SVG file to ImageField seems impossible because SVG file are not supported by the library Pillow, used in ImageField. A way to solve this was to try to create a CustomeImageField model in concrete but that would be ineffective. Another way is to create CustomFileField, but this doesn't have any interest since we can directly add SVG files in base FileField in concrete.

The issue here is that Django uses the PIL library to validate that uploaded files really are images. SVG files aren't supported by PIL, so we would have to find some other way to validate them.
The bigger concern about SVG files is the potential security issue. SVG files can contain javascript. A big part of the reason we use image fields in the first place is to make sure we're only allowing users to upload "safe" files that we know we can show other users without danger of XSS or other nastiness. SVG files can't make that promise.
So for now, it is better that we do not allow SVG files to be uploaded as part of an ImageField.

source : https://code.djangoproject.com/ticket/14092#comment:1