Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable pastezone for jquery.fileupload #23495

Merged
merged 1 commit into from Mar 23, 2016
Merged

Conversation

LukasReschke
Copy link
Member

jquery.fileupload offers the pastezone functionality. This functionality is enabled by default and if somebody copy-pastes something into Chrome it will automatically trigger an upload of the content to any configured jquery.fileupload element embedded in the JS.

This implementation triggers some problems:

  1. The pastezone is defined globally by default (:see_no_evil:). So if there are multiple fileupload's on a page (such as in the personal settings) then stuff is going to be uploaded to all embedded uploads.
  2. Our server code is not able to parse the data. For example for uploads in the files app we expect a file name which is not specified => Just an error is thrown. You can reproduce this by taking a file into your clipboard and in Chrome then pressing CTRL + V.
  3. When copy-pasting some string from MS Office on the personal page a temporary avatar with said content is created. (a little bit of an annoyance if the clipboard contains sensitive data like the password that the user wants to set)

Considering that this is anyways was never working at all and causes bugs I've set the pastezone to null. This mens that upload via copy and paste will be disabled.

Lesson learned: Third-party JS libraries can have some weird defaults.


@PVince81 Thoughts?

jquery.fileupload offers the [`pastezone`](https://github.com/blueimp/jQuery-File-Upload/wiki/Options#pastezone) functionality. This functionality is enabled by default and if somebody copy-pastes something into Chrome it will automatically trigger an upload of the content to any configured jquery.fileupload element embedded in the JS.

This implementation triggers some problems:

1. The pastezone is defined globally by default (:see_no_evil:). So if there are multiple fileupload's on a page (such as in the personal settings) then stuff is going to be uploaded to all embedded uploads.
2. Our server code is not able to parse the data. For example for uploads in the files app we expect a file name which is not specified => Just an error is thrown. You can reproduce this by taking a file into your clipboard and in Chrome then pressing <kbd>CTRL + V</kbd>.
3. When copy-pasting some string from MS Office on the personal page a temporary avatar with said content is created.

Considering that this is anyways was never working at all and causes bugs I've set the `pastezone` to `null`. This mens that upload via copy and paste will be disabled.

Lesson learned: Third-party JS libraries can have some weird details.
@LukasReschke LukasReschke added this to the 9.1-current milestone Mar 22, 2016
@karlitschek
Copy link
Contributor

👍 please backport

@DeepDiver1975
Copy link
Member

👍

@PVince81
Copy link
Contributor

I wasn't even aware about what pastezone is and that we have it enabled... Thanks for disabling it.

@MorrisJobke
Copy link
Contributor

@LukasReschke What about the backport?

@LukasReschke
Copy link
Member Author

@MorrisJobke 9.0.2, will do once 9.0.1 is released

@MorrisJobke
Copy link
Contributor

@MorrisJobke 9.0.2, will do once 9.0.1 is released

Ping :)

@MorrisJobke
Copy link
Contributor

Ping :)

@LukasReschke
Copy link
Member Author

stable9 is at #24281

@lock
Copy link

lock bot commented Aug 6, 2019

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@lock lock bot locked as resolved and limited conversation to collaborators Aug 6, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants