Skip to content

allow all uploads using validate_media_type option

Eric Franz requested to merge alluploads into master

Created by: ericfranz

paperclip 4.2.2 includes validate_media_type option which can be used to disable spoof protection. paperclip 4's spoof detection requires the developer to explicitly add a hash of extension to content types and compares those set in the hash to the mime type returned by the file command

which is useful for validation and protection against spoofing... however the error messages are not helpful and it is an extra step each new developer must take and it makes apps less flexible as they must a head of time specify the exact file extensions allowed

the idea here is that by disabling it by default we offer a faster way to develop apps with less costly hangups

spoof protection is not doing us any good right now - that helps protect against XSS attacks, but that is not something we need to protect against with PUA based apps

Merge request reports