Bug 1160809: Validate the MIME type before uploading attachments

r=dkl a=glob

diff --git a/template/en/default/attachment/createformcontents.html.tmpl b/template/en/default/attachment/createformcontents.html.tmpl
index 48e4f4af0a228c280a6133514d915b333edb125b..293fc3d924f4bc84c9507ecb818ac861cb99f940 100644 (file)
--- a/template/en/default/attachment/createformcontents.html.tmpl
+++ b/template/en/default/attachment/createformcontents.html.tmpl
@@ -68,6 +68,9 @@
       <label for="manual">enter manually</label>:
       <input type="text" name="contenttypeentry" id="contenttypeentry"
              size="30" maxlength="200"
+             pattern="([% constants.LEGAL_CONTENT_TYPES.join('|') FILTER html %])/.+"
+             title="The content type must be of the form 'type/subtype', where 'type'
+                    is one of: [% constants.LEGAL_CONTENT_TYPES.join(', ') FILTER html %]"
              onchange="if (this.value) this.form.contenttypemethod[2].checked = true;">
   </td>
 </tr>

diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl
index b6f612f3fba430dfe9a83f7b41bd48a5655e52de..092f3e76a750c811d9538918f268e361d7c74ffc 100644 (file)
--- a/template/en/default/attachment/edit.html.tmpl
+++ b/template/en/default/attachment/edit.html.tmpl
@@ -94,9 +94,12 @@
             <label for="contenttypeentry">MIME Type:</label>
             <input type="text" size="20" class="text block[% editable_or_hide %]"
                    id="contenttypeentry" name="contenttypeentry"
-                   value="[% attachment.contenttype FILTER html %]">                   
+                   pattern="([% constants.LEGAL_CONTENT_TYPES.join('|') FILTER html %])/.+"
+                   title="The content type must be of the form 'type/subtype', where 'type'
+                          is one of: [% constants.LEGAL_CONTENT_TYPES.join(', ') FILTER html %]"
+                   value="[% attachment.contenttype FILTER html %]">
           </div>
-          
+
           <div id="attachment_creator">
             <span class="label">Creator:</span>
             [%+ INCLUDE global/user.html.tmpl who = attachment.attacher %]