Closed mprins closed 12 years ago
Hi, thanks for your return, translations and corrections.
I change the mimetype control by a config option string and a strpos control.
About security, there are others controls which verifies that we are dealing with an odt file or something like an odt file (it's a zip file with a content.xml file ...). If it not, the file will be deleted.
I make some changes and add a security rules :
I upload the new version tonight.
yeah, I'm not too worried about wrong/invalid uploads either.
On Windows XP using Google Chrome version 19.0.1084.56 m the upload form is sent with
application/octetstream
as mime type, this causes the check for mime type (https://github.com/garlik-gag/dokuwiki-plugin-odt2dw/blob/master/odt2dw/action.php#L284) to fail as it only checks forapplication/vnd.oasis.opendocument.text
Apparently Chrome on Windows does not know about .odt, I have not tested other browsers, but when I comment out this line the upload and processing succeeds.
I think it would be good to check for
application/octetstream
as well and consider this valid (even though this opens the door for other types of files, on windows the mime type is only determined by the file extension so people can upload anything invalid anyway), the other option may be to make this a config option..