Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@johnsaigle
Copy link
Contributor

@johnsaigle johnsaigle commented Dec 4, 2018

Brief summary of changes

This PR picks up on #3514 and introduces an attempt at creating a generic File Upload (Validator) class for use in LORIS file uploads. See attached issue for more details.

The newly Reactified instrument_manager is used as an example to demonstrate how this class should be used.

Related

#4182.

To test this change...

  • Go to the instrument manager and try to upload a file. LINST files should succeed but files such as a PDF or JPG should fail.

@johnsaigle johnsaigle added Category: Feature PR or issue that aims to introduce a new feature State: Discussion required PR or issue that requires the resolution of a discussion with the relevant parties to proceed [branch] major Category: Security PR or issue that aims to improve security labels Dec 4, 2018
@johnsaigle johnsaigle requested a review from xlecours December 4, 2018 22:24
@johnsaigle
Copy link
Contributor Author

johnsaigle commented Dec 4, 2018

Some Design Choices

  • I chose to validate against a whitelist of expected MIME types rather than using file extensions.

    • File extensions are totally controllable by the user so validating against them in the back-end is not useful.
    • MIME types are harder to lie about but require the developer of the module to know exactly what they are expecting
  • The validator class has a property that stores the HTTP response code corresponding to what error occurred. This can be used to group Diactoros responses, as shown in the module

  • Instead of creating an interface I figured it would be better to use this as a base class for modules that need more advanced validation.

@johnsaigle
Copy link
Contributor Author

This needs documentation but is ready for testing.

@davidblader davidblader removed Release: Add to release notes PR whose changes should be highlighted in the release notes labels Dec 7, 2018
Copy link
Contributor

@PapillonMcGill PapillonMcGill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just a few typo in the text

@ridz1208

This comment has been minimized.

@johnsaigle johnsaigle removed the State: Discussion required PR or issue that requires the resolution of a discussion with the relevant parties to proceed label Dec 18, 2018
PapillonMcGill
PapillonMcGill previously approved these changes Jan 7, 2019
@johnsaigle johnsaigle added the State: Needs work PR awaiting additional work by the author to proceed label Jan 14, 2019
@johnsaigle johnsaigle removed the State: Needs work PR awaiting additional work by the author to proceed label Jan 14, 2019
PapillonMcGill
PapillonMcGill previously approved these changes Jan 21, 2019
@johnsaigle
Copy link
Contributor Author

Thanks for the review @xlecours. I addressed some of your points above. I'll also make the rest of the changes you mentioned.

@johnsaigle johnsaigle added the State: Needs work PR awaiting additional work by the author to proceed label Jan 29, 2019
Copy link
Collaborator

@driusan driusan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One comment change that was confusing, and one that was an obvious typo..

@johnsaigle johnsaigle dismissed stale reviews from zaliqarosli via bc15858 July 29, 2019 13:36
@johnsaigle
Copy link
Contributor Author

@driusan I applied your suggestions

@johnsaigle
Copy link
Contributor Author

@driusan Thoughts on merging this?

@johnsaigle
Copy link
Contributor Author

@zaliqarosli Do you mind approving again? Dave asked that i make changes to the documentation but the code is the same as when you last approved

zaliqarosli
zaliqarosli previously approved these changes Aug 12, 2019
@xlecours xlecours mentioned this pull request Aug 12, 2019
3 tasks
Copy link
Contributor

@xlecours xlecours left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added @cmadjar comments that were made on a PR in which I use those classes.

$message = 'Failed to write file to disk';
break;
case UPLOAD_ERR_EXTENSION:
$message = 'File upload stopped by extension';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cmadjar says:

not sure I understand this error. Is it because the extension of the uploaded file is not zip, tar.gz, tar or tgz? If so, maybe rephrase to: "Wrong extension of the file to upload"? Or something like that?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

Also I think we should just go by MIME type. We can check extensions on the front-end if we want to but they don't really matter as long as the actual content is good.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mime type or not, we need to handle this error code.
I think I copy&pasted that https://www.php.net/manual/en/features.file-upload.errors.php#89374

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, reading the description, this is not related to the file extension but rather to a php extension in php.ini

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK so then there are no changes to make?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If @cmadjar asked, then we should probably clarify. It could be File upload stopped by a php extension

Documentation typos

Co-Authored-By: Xavier Lecours <[email protected]>
@johnsaigle johnsaigle dismissed stale reviews from zaliqarosli via 988f967 August 13, 2019 16:20
@johnsaigle johnsaigle requested a review from xlecours August 14, 2019 16:31
*
* @param \SplFileInfo $uploadDirectory The target upload directory
*/
public function __construct(\SplFileInfo $uploadDirectory)
Copy link
Contributor

@xlecours xlecours Aug 15, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a comment/suggestion
The constructor signature should/could be

public function __construct(
    \SplFileInfo $uploadDirectory,
    array $permittedMIMETypes = [],
    int $permissions = 0644,
    bool $overwrite = false
)

That way the default values for the class variables could be removed but you would need to set them in the constructor code block. I think it facilitates the instantiation for non-default values.
Feel free to change it or not (It's your PR.)

@zaliqarosli
Copy link
Contributor

🎉🎉🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Feature PR or issue that aims to introduce a new feature Category: Security PR or issue that aims to improve security Passed manual tests PR has been successfully tested by at least one peer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants