Generalise file upload in run

[rubenarslan]

We need the following changes to the file upload in the run

• file links should be served via the subdomain of the study now that we have subdomains. old links should hard redirect (to avoid XSS)
• we can then allow upload of HTML, JS, CSS, PDF files (no worries about cross-site scripting)
• For people who just want to upload stimulus1 to 50, or people who upload HTML and PDFs, we need to make the file name randomisation optional. It's probably needed less often than normal names are requested.

[rubenarslan]

this comes up quite often, we mask the file names, but this is really mainly a feature to get anonymity. it isn't always desired and comes at the price of meaningless file names. we also no longer need the long names to prevent conflicts between runs. in the future, files should be accessible under study-name.formr.org/assets/file1.jpg etc unless the automatic masking is desired.

[mpw-wwu]

I'm not sure, if this is a good idea. People could easily rip all files from a run. The user/researcher might not always be aware of that. I don't like bossing around the user, but in this case it might make sense.

It's become kind of standard to obfuscate the paths to files nowadays.

[rubenarslan]

People keep asking and we can explain. It's a minority of users so far for whom obfuscation was even a concern. And it's very annoying to substitute in all the filenames for 100 stimuli..

…

On Thu, 22 Nov 2018, 14:30 Matthias P. Walther ***@***.*** wrote: I'm not sure, if this is a good idea. People could easily rip all files from a run. The user/researcher might not always be aware of that. I don't like bossing around the user, but in this case it might make sense. It's become kind of standard to obfuscate the paths to files nowadays. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#403 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAyuhdHQV1bh0WvRP83hYH2gVXa8vGDMks5uxqcRgaJpZM4YvHjy> .

[rubenarslan]

If we implement this, it will be much easier for users to integrate with lab.js and jsPsych.