1. 15 Nov, 2015 7 commits
  2. 12 Nov, 2015 1 commit
  3. 10 Nov, 2015 1 commit
  4. 23 Oct, 2015 1 commit
  5. 09 Oct, 2015 1 commit
    • Output shorter but still useful error message · 8339e0fc
      Before the error message was sometimes millions of characters long.
      
      > [paperclip] Content Type Spoof: Filename a.csv
      > (application/octet-stream from Headers,
      > [#<MIME::Type::Columnar:0x007f9f90f89fa8
      > @container=#<MIME::Types:0x007f9f90b09d98 ... snip millions of
      > characters of output here ...>], @content_type="text/csv",
      > @raw_media_type="text", @raw_sub_type="csv", @simplified="text/csv",
      > @i18n_key="text.csv", @media_type="text", @sub_type="csv",
      > @extensions=["csv"]>] from Extension), content type discovered from
      > file command: application/zip. See documentation to allow this
      > combination.
      
      Now becomes:
      
      > [paperclip] Content Type Spoof: Filename a.csv
      > (application/octet-stream from Headers,
      > ["text/comma-separated-values", "text/csv"] from Extension), content
      > type discovered from file command: application/zip. See documentation
      > to allow this combination.
      
      [fixes #2017]
      Andy Hartford committed
  6. 10 Sep, 2015 2 commits
  7. 09 Sep, 2015 3 commits
  8. 01 Sep, 2015 4 commits
  9. 27 Aug, 2015 4 commits
  10. 24 Aug, 2015 1 commit
  11. 21 Aug, 2015 1 commit
  12. 20 Aug, 2015 5 commits
  13. 31 Jul, 2015 1 commit
  14. 26 Jun, 2015 1 commit
  15. 19 Jun, 2015 1 commit
  16. 18 Jun, 2015 1 commit
  17. 17 Jun, 2015 2 commits
  18. 05 Jun, 2015 3 commits
    • Release v4.3.0 :tada: · ecdd5427
      For the full details of what is included in this release, check out NEWS.
      
      [fixes #1875]
      maclover7 committed
    • Fix a possible security issue with spoofing · 9aee4112
      Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.
      
      There is an issue where if an HTML file is uploaded with a .html
      extension, but the content type is listed as being `image/jpeg`, this
      will bypass a validation checking for images. But it will also pass the
      spoof check, because a file named .html and containing actual HTML
      passes the spoof check.
      
      This change makes it so that we also check the supplied content type. So
      even if the file contains HTML and ends with .html, it doesn't match the
      content type of `image/jpeg` and so it fails.
      Jon Yurek committed