asikart / remoteimage

Asikart RemoteImage helps you manage Joomla CMS image and media files on local and remote FTP host.
http://ext.asikart.com/extensions/asikart-remoteimage.html
10 stars 11 forks source link

Restrict rename #56

Open dvdp opened 9 years ago

dvdp commented 9 years ago

First of all - what a great extension ! This really should be the default joomla media manager !

My remark: you need to disable safe mode to allow renaming of files and folders. I 'm using this extension e.g. for blog intro and full article image upload and creation: upload the image - resize if needed and then make a copy and size it down to thumbnail size (= intro image). Super easy, but I want to rename the copied image to <imagename)_intro.jpg so I need to disable safe mode. With safe mode disabled, someone could upload a fake image and then rename it to e.g. .php which is a security risk so my question is: why not provide a mode that forces to keep the same file name extension. That way, one can only change something.jpg to anythingelse.jpg. Looks to me like a simple change and it provides some extra security.

asika32764 commented 9 years ago

ARI use elFinder as core image manager, so the function that rename file but keep extension name is up to elFinder. Unfortunately It seems elFinder does not provider this feature so I can't do that.

dvdp commented 9 years ago

Hi Simon,

What about the 'acceptedName' elFinder connector option ? If that option could be set from the RemoteImage configuration page, one can control the names of new files I think ..

br Danny

----- Oorspronkelijk bericht -----

Van: "Simon Asika" notifications@github.com Aan: "asikart/remoteimage" remoteimage@noreply.github.com Cc: "dvdp" danny.vandepol@telenet.be Verzonden: Zaterdag 25 juli 2015 18:48:36 Onderwerp: Re: [remoteimage] Restrict rename (#56)

ARI use elFinder as core image manager, so the function that rename file but keep extension name is up to elFinder. Unfortunately It seems elFinder does not provider this feature so I can't do that.

— Reply to this email directly or view it on GitHub .

asika32764 commented 9 years ago

I have to research for this option, I have long time not see connector's code.

If it's works, I will update it.

Thank you for this information.