Attachment Type Restrictions in handler.py not working

Emily · September 9, 2022, 8:46pm

I’d like to restrict Guest and Portal users to only upload certain types of files. From this frappe fix, it looks like I only need to change handler.py.

https://github.com/frappe/frappe/commit/20d73cae24f40a91a0d1d3409ff63273ae3de377

I’ve since removed unwanted types(excel) from the list in handler.py and restart the bench. However, portal users still can upload .xlsx files. Am I missing anything here?

github.com

frappe/frappe/blob/49af8f7db18bb5185d8b71d737a16ad8af96035b/frappe/handler.py#L24


      
          from frappe.core.doctype.server_script.server_script_utils import get_server_script_map
          from frappe.utils import cint
          from frappe.utils.csvutils import build_csv_response
          from frappe.utils.image import optimize_image
          from frappe.utils.response import build_response
          
          
if TYPE_CHECKING:
          	from frappe.core.doctype.file.file import File
          	from frappe.core.doctype.user.user import User
          
          
ALLOWED_MIMETYPES = (
          	"image/png",
          	"image/jpeg",
          	"application/pdf",
          	"application/msword",
          	"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
          	"application/vnd.ms-excel",
          	"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
          	"application/vnd.oasis.opendocument.text",
          	"application/vnd.oasis.opendocument.spreadsheet",
          	"text/plain",

PyJumper · September 10, 2022, 6:50am

hello, you can remove the following to block xlsx
“application/vnd.openxmlformats-officedocument.spreadsheetml.sheet”

here is a reference for other files mimtypes
https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types

Emily · September 10, 2022, 11:41am

Thanks! The list actually only contains JPG, PNG, PDF. However all other types can still be uploaded.


ALLOWED_MIMETYPES = (
	"image/png",
	"image/jpeg",
	"application/pdf",
)

PyJumper · September 10, 2022, 4:08pm

hello, maybe one reason is you need to do bench restart if self hosted or if you are using FrappeCloud go to bench > Versions > restart bench because ALLOWED_MIMETYPES is a global variable

Emily · September 10, 2022, 4:23pm

Self hosted v13 in development mode. Already did bench restart after modifying the list. I’m really confused why the changes has no effect. Not sure if there’s anything else I need to change?