search

nokonoko / Pomf

Simple file uploading and sharing, source for the now shut down site Pomf.se
MIT License
465 stars 98 forks source link

Filename suffix gets discarded if an identical file already exists #45

Open JonasOlson opened 8 years ago

JonasOlson commented 8 years ago

Suppose you upload a file called audio.jpg, and get the URL .../zksebc.jpg back. Then you realise that it had the wrong filename suffix, so you rename it to audio.ogg and upload that one. The URL you then get back will again be .../zksebc.jpg, so you still have the wrong filename suffix.

avail commented 8 years ago

why'd you upload a song file as a jpeg in the first place, though?

AlleSoke1 commented 8 years ago

That's not a bug , it's a feature. Why would you want to have 2 duplicate files in your storage? Also if you want to discover files on host , just create a 10liner python script to try all combinations from a-z and within 26^6 requests you have all the hosting mapped.

JonasOlson commented 8 years ago

why'd you upload a song file as a jpeg in the first place, though?

Why would you want to have 2 duplicate files in your storage?

In my case, I accidentally put the wrong video container file suffix on a video file, uploaded it, realised my mistake, and uploaded the same content with a new filename.

I can also imagine situations where two files of different types can have the same content, for example one plain text file and Markdown file. An empty file is probably valid in many file formats.

Finally, it might be a way to interfere with other users. For example, if an evildoer knows or can guess that a certain file soon will be uploaded, he could upload an identical file under a different name and thus ruin the experience for the legitimate users.