https://bugzilla.wikimedia.org/show_bug.cgi?id=25676
--- Comment #10 from Michael Dale <[email protected]> 2011-03-27 21:24:29 UTC --- (In reply to comment #9) > I would prefer chunked upload support to be in core. IIRC the reason it was > disabled before was that security checks were only done on the individual > chunks and not on the reassembled file, but that should be easy to fix. That vulnerability was only in the extension not in the 'core' version we had deployed. ie line 82 called the parent verifyUpload on the entire upload once we received the last chunk [1]... it was used as the rational for disabling it for who knows why ... but that is really water under a bridge with a dead horse on top ... Happy to add the native html5 blob client side chunk uploading support to upload wizard if we can get any movement on the server side support. [1] http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/upload/UploadFromChunks.php?revision=57732&view=markup&pathrev=59400 -- Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. You are on the CC list for the bug. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
