Project

General

Profile

Development #53720

test_import_export.test_import_export_pwa_navigation en échec après #53666

Added by Frédéric Péters 13 days ago. Updated 13 days ago.

Status:
Solution déployée
Priority:
Normal
Target version:
-
Start date:
04 May 2021
Due date:
% Done:

0%

Estimated time:
Patch proposed:
Yes
Planning:
No

Description

La branche a déjà été retirée ce qui ne permet donc plus la comparaison avec l'état de jenkins quand il buildait celle-ci mais le build qui introduit #53666 est cassé.

https://jenkins.entrouvert.org/job/combo/1913/


Files


Related issues

Related to Combo - Development #53666: Pouvoir définir le nom du fichier attaché retourné par une action de cellule JSON (mode response=raw)Solution déployée03 May 2021

Actions

Associated revisions

Revision 428033da (diff)
Added by Benjamin Dauvergne 13 days ago

pwa: use icon file basename during import (#53720)

Django 2.2.21 introduced the validation of FieldFile.save() name
argument, which cannot contain a path separator anymore. To use the
received FileField value as a base filename, we must apply
os.path.basename() on it first.

ref. https://docs.djangoproject.com/en/3.2/releases/2.2.21/

History

#1

Updated by Frédéric Péters 13 days ago

  • Related to Development #53666: Pouvoir définir le nom du fichier attaché retourné par une action de cellule JSON (mode response=raw) added
#2

Updated by Benjamin Dauvergne 13 days ago

  • Status changed from Nouveau to En cours

Le changement c'est le passage django 2.2.20 à 2.2.21, ça n'a rien à voir avec mon commit:

Django 2.2.21 fixes a security issue in 2.2.20.
CVE-2021-31542: Potential directory-traversal via uploaded files¶

MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names.

In order to mitigate this risk, stricter basename and path sanitation is now applied. Specifically, empty file names and paths with dot segments will be rejected.

M'enfin je regarde quand même.

#3

Updated by Benjamin Dauvergne 13 days ago

#4

Updated by Benjamin Dauvergne 13 days ago

Moche mais ne détonne pas trop au milieu du reste de la méthode.

#5

Updated by Benjamin Dauvergne 13 days ago

  • Status changed from Solution proposée to Résolu (à déployer)
commit 428033da0fa1f1d82977d93190a2b1c9f8bf5305
Author: Benjamin Dauvergne <bdauvergne@entrouvert.com>
Date:   Tue May 4 14:15:30 2021 +0200

    pwa: use icon file basename during import (#53720)

    Django 2.2.21 introduced the validation of FieldFile.save() name
    argument, which cannot contain a path separator anymore. To use the
    received FileField value as a base filename, we must apply
    os.path.basename() on it first.

    ref. https://docs.djangoproject.com/en/3.2/releases/2.2.21/
#6

Updated by Frédéric Péters 13 days ago

  • Status changed from Résolu (à déployer) to Solution déployée

Also available in: Atom PDF