#32718: [3.2.1] Issue with assigning file to FileField
-------------------------------------+-------------------------------------
Reporter: Jakub Kleň | Owner: nobody
Type: Bug | Status: new
Component: Database layer | Version: 2.2
(models, ORM) |
Severity: Release blocker | Resolution:
Keywords: 3.2.1 file model | Triage Stage: Accepted
filefield fieldfile |
Has patch: 1 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Brian Bouterse):
Replying to [comment:10 carderm]:
> Replying to [comment:8 Florian Apolloner]:
> Replying to [comment:7 Mariusz Felisiak]:
>
> **The core issue** was the addition of an unneccessary check added
here:
>
[https://github.com/django/django/blob/main/django/core/files/utils.py#L7]
> {{{
> def validate_file_name(name):
> if name != os.path.basename(name):
> raise SuspiciousFileOperation("File name '%s' includes path
elements" % name)
> }}}
These two lines broke our application which uses the 2.2 LTS. Our
application is shipped, so that's thousands of installations out there all
with various Y versions of our software over the past few years. Even if
we can port our application to use the new `name=...` argument, we would
have to backport and release many older versions, or force our userbase to
upgrade. I agree with @cardem; I see the impact of these two lines as
huge.
Can someone identify what is the motivation for having these two lines? I
don't see how they are required for the CVE, but even if they are, since
the CVE is graded as low, is this appropriate for the LTS?
One of my other concerns is that what I see happening is folks are pinning
to 2.2.20, which is going to prevent them from receiving the moderate CVE
fix for Python 3.9 environments with 2.2.22.
Thank you for all the effort you all put into Django. We couldn't do what
we do without you.
--
Ticket URL: <https://code.djangoproject.com/ticket/32718#comment:18>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.9ccba0f2c1d0f38f9d19a116ac8faa5d%40djangoproject.com.
