Attachment extension upload works when no in ALLOWED_TYPES #11562

GiteaMirror commented

@ovisan commented on GitHub (Aug 30, 2023):

tried also with ALLOWED_TYPES = .json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg

@ovisan commented on GitHub (Aug 30, 2023): tried also with ALLOWED_TYPES = .json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg

GiteaMirror commented

@wxiaoguang commented on GitHub (Aug 30, 2023):

issue attachment or release attachment? what's your app.ini?

@wxiaoguang commented on GitHub (Aug 30, 2023): issue attachment or release attachment? what's your app.ini?

GiteaMirror commented

@ovisan commented on GitHub (Aug 30, 2023):

@wxiaoguang below the full app.ini from the container

gitea-5898c6978c-xhgkg:/# cat /data/gitea/conf/app.ini
APP_NAME = SRE Gitea
WORK_PATH = /data

[indexer]
ISSUE_INDEXER_TYPE = db

[server]
LFS_JWT_SECRET = <REDACTED>
ROOT_URL = https://<REDACTED>
OFFLINE_MODE = true
ENABLE_PPROF = false
SSH_PORT = 22
APP_DATA_PATH = /data
SSH_LISTEN_PORT = 2222
PROTOCOL = http
HTTP_PORT = 3000
START_SSH_SERVER = true
DISABLE_SSH = true
SSH_DOMAIN = <REDACTED>
DOMAIN = <REDACTED>

[database]
NAME = gitea
SSL_MODE = require
DB_TYPE = postgres
HOST = gitea-postgres-primary.<REDACTED>.svc
USER = gitea
PASSWD = <REDACTED>
SCHEMA = public

[service]
DEFAULT_KEEP_EMAIL_PRIVATE = true
REQUIRE_SIGNIN_VIEW = true
DISABLE_REGISTRATION = true
DEFAULT_USER_IS_RESTRICTED = true
EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true]
DEFAULT_ORG_VISIBILITY = private
DEFAULT_USER_VISIBILITY = private
DEFAULT_ALLOW_CREATE_ORGANIZATION = false

[session]
PROVIDER_CONFIG = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
PROVIDER = redis-cluster
SESSION_LIFE_TIME = 1800
GC_INTERVAL_TIME = 1800
COOKIE_SECURE = true

[repository]
ROOT = ~/gitea-repositories
MAX_CREATION_LIMIT = 20
UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999]

[cache]
HOST = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
ENABLED = true
ADAPTER = redis

[security]
INTERNAL_TOKEN = <REDACTED>
SECRET_KEY = <REDACTED>
INSTALL_LOCK = true

[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = true

[queue]
TYPE = redis
CONN_STR = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&

[admin]
DISABLE_REGULAR_ORG_CREATION = true

[ui]
SHOW_USER_EMAIL = false

[metrics]
ENABLED = true

[oauth2_client]
ENABLE_AUTO_REGISTRATION = true

[oauth2]
JWT_SECRET = <REDACTED>

[attachment]
ALLOWED_TYPES = .json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg
FILE_MAX_SIZE = 1024
MAX_FILES = 9999
ENABLED = true

@ovisan commented on GitHub (Aug 30, 2023): @wxiaoguang below the full app.ini from the container ``` gitea-5898c6978c-xhgkg:/# cat /data/gitea/conf/app.ini APP_NAME = SRE Gitea WORK_PATH = /data [indexer] ISSUE_INDEXER_TYPE = db [server] LFS_JWT_SECRET = <REDACTED> ROOT_URL = https://<REDACTED> OFFLINE_MODE = true ENABLE_PPROF = false SSH_PORT = 22 APP_DATA_PATH = /data SSH_LISTEN_PORT = 2222 PROTOCOL = http HTTP_PORT = 3000 START_SSH_SERVER = true DISABLE_SSH = true SSH_DOMAIN = <REDACTED> DOMAIN = <REDACTED> [database] NAME = gitea SSL_MODE = require DB_TYPE = postgres HOST = gitea-postgres-primary.<REDACTED>.svc USER = gitea PASSWD = <REDACTED> SCHEMA = public [service] DEFAULT_KEEP_EMAIL_PRIVATE = true REQUIRE_SIGNIN_VIEW = true DISABLE_REGISTRATION = true DEFAULT_USER_IS_RESTRICTED = true EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true] DEFAULT_ORG_VISIBILITY = private DEFAULT_USER_VISIBILITY = private DEFAULT_ALLOW_CREATE_ORGANIZATION = false [session] PROVIDER_CONFIG = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& PROVIDER = redis-cluster SESSION_LIFE_TIME = 1800 GC_INTERVAL_TIME = 1800 COOKIE_SECURE = true [repository] ROOT = ~/gitea-repositories MAX_CREATION_LIMIT = 20 UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999] [cache] HOST = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& ENABLED = true ADAPTER = redis [security] INTERNAL_TOKEN = <REDACTED> SECRET_KEY = <REDACTED> INSTALL_LOCK = true [openid] ENABLE_OPENID_SIGNIN = true ENABLE_OPENID_SIGNUP = true [queue] TYPE = redis CONN_STR = redis+cluster://:@gitea-redis-cluster-headless.<REDACTED>.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& [admin] DISABLE_REGULAR_ORG_CREATION = true [ui] SHOW_USER_EMAIL = false [metrics] ENABLED = true [oauth2_client] ENABLE_AUTO_REGISTRATION = true [oauth2] JWT_SECRET = <REDACTED> [attachment] ALLOWED_TYPES = .json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg FILE_MAX_SIZE = 1024 MAX_FILES = 9999 ENABLED = true

GiteaMirror commented

@wxiaoguang commented on GitHub (Aug 30, 2023):

issue attachment or release attachment?

@wxiaoguang commented on GitHub (Aug 30, 2023): issue attachment or release attachment?

GiteaMirror commented

@wxiaoguang commented on GitHub (Aug 30, 2023):

ps: the generated config is not right.

EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true]

...

UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999]

@wxiaoguang commented on GitHub (Aug 30, 2023): ps: the generated config is not right. ``` EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true] ... UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999] ```

GiteaMirror commented

@ovisan commented on GitHub (Aug 30, 2023):

I am trying to commit the files, so neither issue or release

@ovisan commented on GitHub (Aug 30, 2023): I am trying to commit the files, so neither issue or release

GiteaMirror commented

@ovisan commented on GitHub (Aug 30, 2023):

ps: the generated config is not right.

EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true]

...

UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999]

That is generated from the helm chart. Should i open a bug there?

@ovisan commented on GitHub (Aug 30, 2023): > ps: the generated config is not right. > > ``` > EXPLORE = map[DISABLE_USERS_PAGE:true REQUIRE_SIGNIN_VIEW:true] > > ... > > UPLOAD = map[ALLOWED_TYPES:.json,.csv,.xls,.xlsx,.sav,.dta,.por,.sas,.stata,.geojson,.gpkg ENABLED:true FILE_MAX_SIZE:1024 MAX_FILES:9999] > ``` That is generated from the helm chart. Should i open a bug there?

GiteaMirror commented

See https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini

@wxiaoguang commented on GitHub (Aug 30, 2023):

That is generated from the helm chart. Should i open a bug there?

I think so.

And, there are 3 different "ALLOWED_TYPES":

;[attachment]
;ALLOWED_TYPES
;[repository.upload]
;ALLOWED_TYPES =
;[repository.release]
;ALLOWED_TYPES =

@wxiaoguang commented on GitHub (Aug 30, 2023): > That is generated from the helm chart. Should i open a bug there? I think so. ---- And, there are 3 different "ALLOWED_TYPES": See https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini ``` ;[attachment] ;ALLOWED_TYPES ;[repository.upload] ;ALLOWED_TYPES = ;[repository.release] ;ALLOWED_TYPES = ```

GiteaMirror commented

@ovisan commented on GitHub (Aug 30, 2023):

yes, i have entries for ALLOWED_TYPES in [attachment] and [repository.upload]. Normally i should not be able to upload any other files with the extension not in ALLOWED_TYPES, right?

@ovisan commented on GitHub (Aug 30, 2023): yes, i have entries for ALLOWED_TYPES in [attachment] and [repository.upload]. Normally i should not be able to upload any other files with the extension not in ALLOWED_TYPES, right?

GiteaMirror commented

@wxiaoguang commented on GitHub (Aug 30, 2023):

If your config options are right and there is no bug and you are using the related "upload page", then the answer is yes.

But at the moment I have no idea what's your config content, or which page you are visiting, or whether there is a bug.

@wxiaoguang commented on GitHub (Aug 30, 2023): If your config options are right and there is no bug and you are using the related "upload page", then the answer is yes. But at the moment I have no idea what's your config content, or which page you are visiting, or whether there is a bug.

GiteaMirror commented

@wxiaoguang commented on GitHub (Aug 30, 2023):

I am trying to commit the files, so neither issue or release

If you mean "git commit", it is never limited by these config.

@wxiaoguang commented on GitHub (Aug 30, 2023): > I am trying to commit the files, so neither issue or release If you mean "git commit", it is never limited by these config.

GiteaMirror commented