Comments (10)
Maybe the start-with field should be required... I'm thinking it should default to 'uploads' . This might break some peoples implementations, but its easy to fix and I think a needed security measure.
#56 addresses this.
from s3_direct_upload.
I agree that it should be required and default to 'uploads/'.
Do you think it should also raise an exception if it's not set to the stem of the key, or blank? Perhaps that's not required as the S3 error responses are quite self-explanatory.
from s3_direct_upload.
Just came back to working on my uploader and ran into this very same concern. Thanks for getting the fix in, guys. This is a critical security issue. Can we look forward to a new release with this fix + the jqeury 1.9 fix soon?
from s3_direct_upload.
yes. I'll bump the version tomorrow.
from s3_direct_upload.
Sweet, thanks.
from s3_direct_upload.
I have just released version 0.1.0 that defaults key_starts_with to 'uploads/'.
from s3_direct_upload.
You defaults key_starts_with to 'uploads/' but you never use it. Your key method does not use this configuration option. Why?
from s3_direct_upload.
Internally it will always be 'uploads/' until the user changes it. Then they must also change the key. Do you have a better implementation? Maybe one where they don't have to change key? just key_starts_with?
from s3_direct_upload.
@arfl I think I see what you are getting at. I have refactored this here: 3227bd0
from s3_direct_upload.
That's what I meant... Cool
from s3_direct_upload.
Related Issues (20)
- rake s3_direct_upload:clean_remote_uploads not working
- add an integration test or javascript test
- Adding STS HOT 1
- jquery file upload Vulnerability
- ${cleaned_filename} is not working HOT 9
- How to resize an image before uploading to S3 HOT 2
- Filepath comes without starting slash on IE HOT 1
- File not selected HOT 2
- Returns incorrect asset URL when file name includes a space HOT 1
- data.context is empty on progress upload
- $(...).S3Uploader is not a function HOT 2
- Progress not shown HOT 4
- How to customize max_file_size error message
- Should CORS be abandoned?
- Adding tags to POST request is not documented HOT 1
- Binding event for multiple elements based on classname
- Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://eu-west-1.amazonaws.com/duk-assets-uat/. (Reason: CORS request did not succeed). HOT 1
- Should add an s3_uploads_stop to the mix
- before_add doesn't accept promise
- Can anyone confirm if this gem works in Rails 6? HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from s3_direct_upload.