Comment 15 for bug 224971

Dougie Richardson pisze:

>> 2) restrict wiki attachements to non-html ones
>
> I don't understand why anything other than images is allowed,

Archives are often uploaded to wiki - themes, mockups, documents, pdfs, etc.

> there is
> still the vulnerabilities with GIF/JPG of course. There is also the
> problem of identifying the files being uploaded - extension is not
> enough as it can be renamed.

Just check the mime type.

>> Any other suggestions?
>
> I have got one, which is fairly fool proof unfortunately very time
> consuming - introduce a method of approving all new pages from new
> usernames for a certain period of time. At the lowest level, we could
> restrict wiki edits to 24 hours after first registration or go the whole
> distance and say, disallow un-approved pages until contributing for a
> certain length of time.

Yeah, disallowing of creating new pages or uploading attachements for
ie. 1 day after registration would be good.
--
## Przemysław Kulczycki <<>> Azrael Nightwalker ##
# jabber: azrael[na]jabster.pl | tlen: azrael29a #
### www: http://reksio.ftj.agh.edu.pl/~azrael/ ###