Validate file uploads

[EmilyDirsh]

Currently file uploads are not validated. We should be restricting the type and size of files permitted to be uploaded.

This is a potential security issue, and can certainly cause a lot of usability issues if we try to treat something as an image that isn't.

Relevant: http://stackoverflow.com/questions/51572/determine-file-type-in-ruby

[sbagroy986]

On it!

[sbagroy986]

Found a gem for it. What file formats should I add as supported @EmilyDirsh ? JPEG and PNG?

[Alwahsh]

Why not make it configurable ?

[sbagroy986]

I don't understand what you mean. Configurable how?

[Alwahsh]

For example, an Array with accepted formats put in the configuration file in initializers. Allow everything in that array and reject the rest

[sbagroy986]

That is what I am doing :)

[EmilyDirsh]

@sbagroy986, @Alwahsh is right - the whitelist should be configurable in the Rails config files. Check the documentation for the gem you're using - there should be a documented configuration parameter for the gem.

By default, we should allow jpg, png, gif (why not?), and svg

[sbagroy986]

The gem actually just provides us the format of the file. So basically I'm gonna create an array of acceptable formats. The list is, thus, configurable.

[EmilyDirsh]

@sbagroy986 which gem are you using?

[sbagroy986]

Ruby FileMagic - https://github.com/blackwinter/ruby-filemagic
Its basically libmagic for ruby.

[sarupbanskota]

What's the status on this? If it's yet to be worked on, @sonalkr132 would like to take it up.