Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

ACF Compatibility for this.blockedExtForFileUpload in Application.cfc

Description

CF2018 Update 3, CF2016 Update 10 and CF11 Update 18 all support a new Application.cfc setting `this.blockedExtForFileUpload` which allows for a comma separated list of file extensions to block from upload in cffile, fileUpload, fileUploadAll. The setting also accepts a `*` which disables all uploads (quite a nice feature), and an empty string will give the legacy behavior of allowing everything.

I see that Lucee has added a similar system property or environment variable `lucee.upload.blacklist` here https://github.com/lucee/Lucee/commit/9dfdf2e2306e8551760e8b9389c775198890de26

It is essential to have this setting at a code level, because then the developer can define what is allowed, and doesn't have to rely on how the application is deployed.

Adobe's Documentation: https://helpx.adobe.com/coldfusion/cfml-reference/application-cfc-reference/application-variables.html#blockedext

Activity

Show:

Pete Freitag 9 September 2019 at 16:42

- ok I’ve created a new ticket here: https://luceeserver.atlassian.net/browse/LDEV-2454 and marked them as related.

Zac Spitzer 11 July 2019 at 07:50

filing a new bug and linking back is the usual approach with Lucee

Pete Freitag 10 July 2019 at 21:30

Let me know if I should create a new ticket or if this one should be reopened.

Pete Freitag 10 July 2019 at 21:30

It looks like this was partially implemented… It does seem to check the extensions but I don’t see it supporting values “*” or ““ as indicated in my ticket description. It should be pretty straight forward to add these and make it fully compatible with ACF.

Marilou Landes 26 April 2019 at 17:02

I agree with Tom Chiverton… any chance of a back port to 5.3.1; or, can it be added to the 5.3.2 release candidate, please?

Fixed

Details

Assignee

Reporter

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Fix versions

Priority

Created 7 March 2019 at 14:39
Updated 17 October 2022 at 07:46
Resolved 18 April 2019 at 23:02

Flag notifications