zhangyuheng/MrDoc
1
0
Fork 0
forked from mirror/MrDoc
Code Pull Requests Activity

默认禁止上传SVG格式图片，以避免svg图片的xss攻击

Browse Source
This commit is contained in:
zmister 2021-09-03 10:27:03 +08:00
parent a33886e858
commit 00c26e9c7c
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@ -3,6 +3,7 @@
### v0.7.1 2021-09
- [修复]用户上传文件中yaml加载的安全漏洞；
- [优化]默认禁止上传SVG图片（有安全风险）；
### v0.7.0 2021-08-31

2
MrDoc/settings.py
View File

@ -195,7 +195,7 @@ MEDIA_URL = '/media/'
MEDIA_ROOT = os.path.join(BASE_DIR,'media')
# 允许上传的图片后缀
ALLOWED_IMG = CONFIG.get("image_upload","suffix_name",fallback="jpg,jpeg,gif,png,bmp,webp,svg").split(",")
ALLOWED_IMG = CONFIG.get("image_upload","suffix_name",fallback="jpg,jpeg,gif,png,bmp,webp").split(",")
REST_FRAMEWORK = {