SparkDevNetwork / Rock

An open source CMS, Relationship Management System (RMS) and Church Management System (ChMS) all rolled into one.
http://www.rockrms.com
577 stars 348 forks source link

File Uploads Don't Follow Preferred Format settings from BinaryFileType #5939

Closed ghost closed 2 months ago

ghost commented 2 months ago

Description

The Binary File Types allow for a Preferred Format to be set such as PDF, PNG, JPEG, etc. This property limits the files that can be uploaded to just that specific file type; however, it does not appear to work with the Azure Blob Storage provider, and upon further inspection on the demo site it doesn't appear to work with the Database provider either.

I've checked using Github Code Search to see where “Preferred Format” and only found it in 13 files. Github Code Search results Code Search Screenshot

As shown in the screenshot, these references are mostly declarations of properties in the class files or just references for the edit panel in BinaryFileTypeDetail block. From the simple search, I see no references to “PreferredFormat” being used to validate the files uploaded.

There are also no references to “PreferredFormat” in FileUploader.ashx.cs but there are references to BinaryFileType, just not anything more than its Guid. FileUploader.ashx.cs FileUploader.ahx.cs search

We tested this on our own site using the Azure Blob Storage provider and found that it didn’t validate the files being uploaded in a Workflow. We later tested this on the demo site with both a Workflow and a Person Attribute. These demo site tests failed to validate the file despite it being listed on the BinaryFileType.

Binary File Type

BinaryFileType Creation

Workflow

Workflow Type Detail Workflow File Attribute Workflow Form Workflow Entry Details

Person Attribute

Person Attribute Detail Person Attribute Upload

Actual Behavior

File uploads for Person Attribute and in Workflows are successful even if they don't follow the Preferred Format on the BinaryFileType.

Expected Behavior

File uploads for Person Attribute and in Workflows should fail if they don't match the settings declared in the BinaryFileType. Initially this seemed like it might be a problem with just the Azure Blob Storage provider, but it appears to be with all files and stretching back all the way to v14.3.

I think a fix for this could either be included in the FileUploader.ashx.cs file or in the Field Type for File. Not sure where it should be included, but PreferredFormat is barely used in the codebase.

Steps to Reproduce

  1. Create a BinaryFileType with a PreferredFormat and Preferred Settings Required checked to true.
  2. Create a WorkflowType with a File attribute that uses the newly created BinaryFileType.
    1. Persist the Workflow
  3. Add a Form to the WorkflowType
    1. Make the File visible, editable, and required
  4. Fill out the form with a file that is NOT the Preferred Format from the BinaryFileType.
  5. The file upload is successful, despite not matching the Preferred Format.

OR

  1. Create a BinaryFileType with a Preferred Format and Preferred Settings Required checked to true.
  2. Create a Person Attribute with any Category so it is visible on the Person Profile.
  3. Upload a file to the Person Attribute that doesn’t follow the Preferred Format from the BinaryFileType.
  4. The file upload is successful, despite not matching the Preferred Format.

Issue Confirmation

Rock Version

14.3, 16.4, 16.5

Client Culture Setting

en-US

nairdo commented 2 months ago

Hi @nlBayside , That old "Preferred Format" was only used by a now defunct, legacy windows application that was used to upload documents into Rock. Regardless, we're looking into this to see if it's a feature we want to add to Rock core now.

zackdutra commented 2 months ago

Hey @nairdo, thank you for the explanation. It's disappointing that the setting isn't clearly documented in the block. I did just refer to the manual, and according to the documentation, the document needs to conform to the configuration, but it also notes that the file type setting may not work. Can you clarify which settings on this block we should expect to function? @nlBayside thinks it's possible only the max file size is checked.

The settings include: Max File Size Maximum Width Maximum Height Preferred Color Depth Preferred Format Preferred Resolution Preferred Settings Required

Thank you for your help!

nairdo commented 2 months ago

@zackdutra Yes, those are exactly the items we're discussing -- which ones should it should possibly support, and if it is only a limited set, the tooltip for the Preferred Settings Required field would be updated to mention this.

The documentation you reference is for the Workflow action for adding new documents, but this sentence might seem unclear about who is responsible (to ensure the document "you're trying to add needs to conform") but it currently means you, the workflow creator:

Similarly, the document you’re trying to add needs to conform to the File Type configuration for the File Type that’s associated with the Document Type you’re using.

At the moment I would agree with @nlBayside that the FileUploader (file handler) is currently only looking at the Max File Size value for the binary file type (~line 327).

I'll post an update once we've determined how we're going to proceed.

nairdo commented 2 months ago

To avoid future confusion, we are going to remove three of the preferred settings (Preferred Format, Preferred Resolution, Preferred Color Depth) from the BinaryFileTypeDetail block UI since these should have been removed when the Spark Document Scanner app was discontinued many years ago. However we are going to add validation checking for Max Width and Max Height (for image files) when the Preferred Settings Required is enabled.

zackdutra commented 2 months ago

Appreciate the follow up @nairdo - for anyone in the future looking for a workaround for workflows, here's what we're doing now to validate our own files.

The downside to this is that it can result in junk files in the database. We may create an action to delete the rejected file as well.

Screenshot 2024-07-12 at 12 11 45 PM Screenshot 2024-07-12 at 12 11 16 PM Screenshot 2024-07-12 at 12 11 03 PM