Difficult to override starts-with policy on key about s3_direct_upload HOT 10 CLOSED

Maybe the start-with field should be required... I'm thinking it should default to 'uploads' . This might break some peoples implementations, but its easy to fix and I think a needed security measure.

#56 addresses this.

from s3_direct_upload.

I agree that it should be required and default to 'uploads/'.

Do you think it should also raise an exception if it's not set to the stem of the key, or blank? Perhaps that's not required as the S3 error responses are quite self-explanatory.

from s3_direct_upload.

Just came back to working on my uploader and ran into this very same concern. Thanks for getting the fix in, guys. This is a critical security issue. Can we look forward to a new release with this fix + the jqeury 1.9 fix soon?

from s3_direct_upload.

yes. I'll bump the version tomorrow.

from s3_direct_upload.

Sweet, thanks.

from s3_direct_upload.

I have just released version 0.1.0 that defaults key_starts_with to 'uploads/'.

from s3_direct_upload.

You defaults key_starts_with to 'uploads/' but you never use it. Your key method does not use this configuration option. Why?

from s3_direct_upload.

Internally it will always be 'uploads/' until the user changes it. Then they must also change the key. Do you have a better implementation? Maybe one where they don't have to change key? just key_starts_with?

from s3_direct_upload.

@arfl I think I see what you are getting at. I have refactored this here: 3227bd0

from s3_direct_upload.

That's what I meant... Cool

from s3_direct_upload.