So it came to my attention today that by default (or at least here on Meta) there are a few major file types missing from the upload option. It would be great if the default (and Meta) allowed users to upload file types such as Word Docs, Excel Sheets, PDFs, etc. as these are the most likely files users would want to upload.
Below are the options on our own instance which I am fairly confident have not been changed - this is extremely restrictive.
Those would be potential security exploits if enabled globally. I suggest just enabling what you need on your instance as you see fit.
How much of a security risk do you think adding pdf extensions would be?
High. Do users regularly need to upload PDFs?
No, I don’t allow file uploads either. I was just checking best practices.
@codinghorror - would the plugin at https://meta.discourse.org/t/google-docs-onebox-for-discourse/26247/29 have the same security implications since the files are stored on Google Drive? I wouldn’t think so, but figured I’d check with you before I brought the idea to Bill…
Google Drive has a virus scanning policy which reduces the risks:
Virus scanning: Google Drive scans a file for viruses before the file is downloaded or shared. If a virus is detected, users can’t share the file with others, send the infected file via email, or convert it to a Google Doc, Sheet, or Slide, and they’ll receive a warning if they attempt these operations. The owner can download the virus-infected file, but only after acknowledging the risk of doing so.
Only files smaller than 25 MB can be scanned for viruses. For larger files, a warning is displayed saying that the file can’t be scanned.
이 질문이 5년 전의 것임을 알지만, 여전히 유효하다고 생각합니다. PDF 업로드를 허용하는 것의 보안 위험과 문제는 무엇인가요?
현대 PDF 클라이언트에서는 대체로 비교적 안전합니다:
요즘 Firefox에는 네이티브 렌더러가 있어 위험을 더욱 줄여줍니다.
그럼에도 불구하고, 대부분의 Discourse 포럼에서는 이 기능을 활성화할 필요가 없다고 생각합니다. 따라서 현재 기본 설정이 적절하다고 봅니다.