retoor/devplacepy
1
0
Fork 1
Code Issues 44 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

feat: remove .html and .svg from allowed upload types and MIME mappings

Browse Source 
Remove HTML and SVG file extensions from the ALLOWED_UPLOAD_TYPES dictionary and their corresponding MIME type entries from MIME_TO_EXT in attachments.py, preventing users from uploading these potentially unsafe file formats through the API.
This commit is contained in:
retoor
2026-06-16 06:50:16 +00:00
parent 99ed5c4f15
commit a618a95671
7 changed files with 86 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/bookmarks/saved.py
+1 -1
View File
@@ -131,7 +131,7 @@ def test_audit_log_pagination_preserves_filters(alice):
assert "event_key=security.authz.denied" in href
assert "page=2" in href
next_link.first.click()
page.wait_for_url("**page=2**", wait_until="domcontentloaded")
page.wait_for_url("**/admin/audit-log?**page=2**", wait_until="domcontentloaded")
assert "event_key=security.authz.denied" in page.url
# the filter is still applied on page 2: every visible event badge matches
badges = page.locator(