-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Closed
Labels
Description
Steps to reproduce
- set
blacklisted_filesto some file name(s) inconfig.php- e.g.["blacklisted-file.txt",".htaccess"] - use v1 chunking to try and upload a file called
blacklisted-file.txt
Expected behaviour
HTTP status 403 (like when you try an ordinary upload, or upload using v2 chunking)
Actual behaviour
HTTP status 507
Server configuration
Current core master
See acceptance test scenarios in PR #36643 uploadFileUsingOldChunking.feature
Note:
-
there is is similar behaviour if the file name matches one of the names in
excluded_directories- so that "excluding directories" option is being processed in just the same way asblacklisted_files -
the upload does fail (i.e. it is effectively blacklisted). The problem is just that the HTTP 507 status is not "correct" (not consistent with 403 given by other upload methods)
Reactions are currently unavailable