client/AllowUpload()

ID:133371
 
Oct 17 2008, 9:14 am
Status: Open
Issue hasn't been assigned a status value.
New feature: The new /client/AllowUpload() proc allows you to decide whether to accept a file from a player or not. The two arguments are the filename, and the length in bytes. If you return a true value (the default) from this proc, the upload is allowed. Otherwise, the command or input() that was being used will send back null instead of a file reference.
--Lummox JR

This is a very cool-sounding feature. Very elegant way of handling that "as filesave" suggestion way back when.

However, is there going to be any way for the client to report what kind of file it is uploading (independent of filename, which is easily spoofed) and/or a way for the server to have a chance at verifying the file type upon receipt? BYOND still tends to trust the client far too much when it comes to invalid data, particularly during file uploads.
Oct 17 2008, 10:26 am
Jtgibson wrote:
New feature: The new /client/AllowUpload() proc allows you to decide whether to accept a file from a player or not. The two arguments are the filename, and the length in bytes. If you return a true value (the default) from this proc, the upload is allowed. Otherwise, the command or input() that was being used will send back null instead of a file reference.
--Lummox JR

This is a very cool-sounding feature. Very elegant way of handling that "as filesave" suggestion way back when.

However, is there going to be any way for the client to report what kind of file it is uploading (independent of filename, which is easily spoofed) and/or a way for the server to have a chance at verifying the file type upon receipt? BYOND still tends to trust the client far too much when it comes to invalid data, particularly during file uploads.

I was about to suggest the same, but I second this.

Since AllowUpload presents a nice barrier for file uploads, I think it'd be better for filetype checking be done there -- perhaps the default action of the proc could be to do as such? I'd personally like something like this quite nice:

client
   AllowUpload(filename,filesize,filetype) //filetype would be a constant of some variety based on the 'as' clause of the input
      . = ..() //default action would be to assert that the file uploaded was actually
      //the type expected (with the exception of 'file' I'd assume, since that could be
      //allowed to be anything and would be the developer's problem)
      if(.) //the file uploaded is the type expected (or was 'as file', which returns true regardless)
         if(filetype == SOUND_FILETYPE && filesize <= 512000) return 1 //I only want sound uploads in my project!
Oct 17 2008, 10:33 am
There are quite a bit of file-types and with some file-types having the same type of header as others and others having completely anomalous headers, how can these file be checked correctly and efficiently?
Oct 17 2008, 11:46 am
In response to CaptFalcon33035
As I brought up in the old "filesave" thread (a search should bring up this thread and the old thread), we'd logically want to check for a few types:

* Sound file (any audio format supported by BYOND)
* Plain text (file consists of /[A-Za-z\xE4\xE5...\d\s\r\n]*/ with no other formatting characters)
* Savefile (BYOND savefile format)
* DMI file

Anything else would be inherently suspect and would presumably be parsed through forthcoming binary support and/or a custom DLL.
Nov 16 2013, 5:29 pm
I'd like to bump this.
So...bump.

Basically, this feature is still kind of relevant. It was created before the Feature Tracker existed, so, DarkCampainger moved it here per request. (thanks!)