#30745: Allow serving a default file for FileField from static URL.
------------------------------------------------+------------------------
Reporter: bhch | Owner: nobody
Type: New feature | Status: new
Component: File uploads/storage | Version: 2.2
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
------------------------------------------------+------------------------
Prior to version 1.9, it was possible to serve a default file for a
`FileFIeld` from an absolute url just by setting the `default` value on
the field like:
{{{
ImageField(default='/static/placeholder.png' ...)
}}}
But due to the security concerns raised in #25905, the commit
[changeset:"fdf5cd3429369954e8deb764d9f30f6374581613" fdf5cd34] strips off
all the leading slashes thereby making the path relative to which
`urljoin` later prepends a base url. This removes the possibility of
serving a default file from the static url.
I think a better solution would be to remove more than 1 leading slashes,
but not one.
Current implementation: `url.lstrip('/')`.
Proposed: `re.sub(r'/{2,}', '/', url)` or `re.sub(r'/{2,}', '', url)`.
This will keep the absolute urls as intended and also convert external
urls to internal.
--
Ticket URL: <https://code.djangoproject.com/ticket/30745>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/047.bc1e7e9615d91d2bf49da3f349f29978%40djangoproject.com.
