Timeline for Is "Replace file" a potential security hole?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2015 at 23:41 | comment | added | Jim Newton | One quick solution would be to figure out how to use environmental variables when defining the Asset itself. The included sample about environmental variables already talks about using different folders for "prod" and "dev" environments; I could create an array for different users instead such as "billgates" and "larryellison" etc. (For security reasons, I might have to define a new field for each user called "nickname" which can be used when creating a folder.) The trust issue is very difficult for me to address. As a technical guy, I wouldn't want to leave anything to user discretion. | |
| Mar 16, 2015 at 23:39 | comment | added | Jim Newton | RitterKnight: Your solutions would work if I have one intern. If I have 10 interns, I will have to create 10 new fields, each of mapped to a jailed folder. The Entry creation form will be a jumbled mess -- and I can't imagine how messy the twig markup will have to be to output that data. I am not exactly sure how the solution needs to be implemented, but when am using ExpressionEngine I have a plug-in that restricts the uploads to a single folder based on entry slug. | |
| Mar 16, 2015 at 16:46 | history | answered | RitterKnight | CC BY-SA 3.0 |