diff options
| author | Luke Plant <L.Plant.98@cantab.net> | 2011-07-06 23:44:54 +0000 |
|---|---|---|
| committer | Luke Plant <L.Plant.98@cantab.net> | 2011-07-06 23:44:54 +0000 |
| commit | f5c9c2246e4b01f8731550c2a10241ca0e0148e9 (patch) | |
| tree | ff952cfe71ce40a7c953fb5fb8d72e33bbd8cd5d /docs/ref | |
| parent | 569aa34ea5eec46ec0d899f4db682687964feec0 (diff) | |
Improved warning about file uploads in docs, and added link from security overview page
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16521 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/models/fields.txt | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/ref/models/fields.txt b/docs/ref/models/fields.txt index 7765f2f8eb..95f01e640a 100644 --- a/docs/ref/models/fields.txt +++ b/docs/ref/models/fields.txt @@ -577,6 +577,8 @@ The uploaded file's relative URL can be obtained using the this calls the :meth:`~django.core.files.storage.Storage.url` method of the underlying :class:`~django.core.files.storage.Storage` class. +.. _file-upload-security: + Note that whenever you deal with uploaded files, you should pay close attention to where you're uploading them and what type of files they are, to avoid security holes. *Validate all uploaded files* so that you're sure the files are @@ -585,6 +587,10 @@ without validation, to a directory that's within your Web server's document root, then somebody could upload a CGI or PHP script and execute that script by visiting its URL on your site. Don't allow that. +Also note that even an uploaded HTML file, since it can be executed by the +browser (though not by the server), can pose security threats that are +equivalent to XSS or CSRF attacks. + By default, :class:`FileField` instances are created as ``varchar(100)`` columns in your database. As with other fields, you can change the maximum length using the :attr:`~CharField.max_length` argument. |