-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Some upload filetypes no longer work in latest (0.6.22) version #3102
Comments
I‘ll Check, as workaround you can deactivate the upload check in admin -> basic config -> security settings -> … |
Oh didn't know about that option 😍 That will definitely be useful, thx! 💪 |
I knew this would happen |
I added the correct file type check, please update to the newest nightly version, the upload should work now |
Wow, quickest fix I've ever seen 👀 I've seen where the error was, nice catch. Congrats on such amazing tool and support. 🙏 🎉 |
I‘d like to leave it open till the next release |
Doesn't seems to be fixed, I had to uncheck " Check if file extensions matches file content on upload" to upload my ebook successfully (V 0.6.23 Teofila, Windows) |
Describe the bug/problem
After updating to the latest version, where Python-magic has been addedd to validate myme-types (PR 3061), some uploads fail.
My assumption is that some magicnumbers might be missing, since it only appears to happen with some specific files.
Here's an example where both files are M4B (which is accepted according to EXTENSIONS_UPLOAD constant), but one uploads and the other doesn't:
The first one doesn't work, and I haven't been able to find any reference to that Magic number, although it appears to be some sort of reference to M4A and M4A is also accepted according to EXTENSIONS_UPLOAD constant:
0000 001c 6674 7970 4d34 4120 0000 0001 4d34 4120 6d70 3431 6d70 3432
-> Doesn't workThe second one does work and I've found it belongs to MPEG4 Part 14.
0000 0020 6674 7970 6973 6f6d 0000 0200 6973 6f32 6d70 3431 4d34 4120
-> WorksTo Reproduce
Steps to reproduce the behavior:
File type isn't allowed to be uploaded to this server
":Logfile
Add content of calibre-web.log file or the relevant error, try to reproduce your problem with "debug" log-level to get more output.
Expected behavior
All valid files should be accepted. Either this (and any other missing) magic number is also allowlisted, or instead we opt for a denylist approach with only malicious files (executables and such) are denied, which would be much more maintainable and aligned with any future improvement (such as the adition of a ClamAV or similar upload scan).
Environment (please complete the following information):
Additional context
N/A
The text was updated successfully, but these errors were encountered: