From: Frédéric Buclin <LpSolit@gmail.com>
Date: Thu, 14 May 2015 13:05:09 +0000 (+0200)
Subject: Bug 1160809: Validate the MIME type before uploading attachments
X-Git-Tag: release-5.1.1~248
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd4bfe35ac0c3c7808bedf99a9f6c68b16ec215b;p=thirdparty%2Fbugzilla.git

Bug 1160809: Validate the MIME type before uploading attachments
r=dkl a=glob
---

diff --git a/template/en/default/attachment/createformcontents.html.tmpl b/template/en/default/attachment/createformcontents.html.tmpl
index 48e4f4af0a..293fc3d924 100644
--- a/template/en/default/attachment/createformcontents.html.tmpl
+++ b/template/en/default/attachment/createformcontents.html.tmpl
@@ -68,6 +68,9 @@
       <label for="manual">enter manually</label>:
       <input type="text" name="contenttypeentry" id="contenttypeentry"
              size="30" maxlength="200"
+             pattern="([% constants.LEGAL_CONTENT_TYPES.join('|') FILTER html %])/.+"
+             title="The content type must be of the form 'type/subtype', where 'type'
+                    is one of: [% constants.LEGAL_CONTENT_TYPES.join(', ') FILTER html %]"
              onchange="if (this.value) this.form.contenttypemethod[2].checked = true;">
   </td>
 </tr>
diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl
index b6f612f3fb..092f3e76a7 100644
--- a/template/en/default/attachment/edit.html.tmpl
+++ b/template/en/default/attachment/edit.html.tmpl
@@ -94,9 +94,12 @@
             <label for="contenttypeentry">MIME Type:</label>
             <input type="text" size="20" class="text block[% editable_or_hide %]"
                    id="contenttypeentry" name="contenttypeentry"
-                   value="[% attachment.contenttype FILTER html %]">                   
+                   pattern="([% constants.LEGAL_CONTENT_TYPES.join('|') FILTER html %])/.+"
+                   title="The content type must be of the form 'type/subtype', where 'type'
+                          is one of: [% constants.LEGAL_CONTENT_TYPES.join(', ') FILTER html %]"
+                   value="[% attachment.contenttype FILTER html %]">
           </div>
-          
+
           <div id="attachment_creator">
             <span class="label">Creator:</span>
             [%+ INCLUDE global/user.html.tmpl who = attachment.attacher %]