Open jrief opened 7 months ago
Just sharing my bandaid solution here:
This still continues to upload the file in upload temp.
But it successfully prompts users that Upload Fail
and it fails to update the Download Button href.
Thus, for security checks of the system it will avoid other people from "officially" uploading unwanted filetypes as well download them
class FormViewMixin
def _receive_uploaded_file(self, file_obj, image_height=None):
response = super()._receive_uploaded_file(file_obj, image_height)
_data = json.loads(response.content)
allowed_content_types = ["application/pdf", "image/png", "image/jpeg"]
if _data['content_type'] in allowed_content_types:
return response
If the file upload uses attribute
{'accept': 'image/jpeg'}
it still is possible to upload files using drag & drop. There should be a better validation.