Comments (1)
Great project, we are just starting to use it. Hope uploading implementations are a thing of the past now
Thank you a lot for these kind words :)
The uploaded files are created with the executable bit true. For everyone! -rwxr-xr-x
I would prefer them not executable.
Mostly true! Actually the file are created using 0775 (-rwxrwx-r-x), see
Line 31 in be8fd83
For me this could be one part of an attack strategy with some trojan. It's clear that there has to be a second exploit at least to complete the big picture. But early intervention is king here.
Agreed, this needs to be changed.
I don't know exactly if this could be changed by the os configuration or is caused by it (Ubuntu 16.04, pretty default install). Other uploads and tmp outside of tusd are not executable.
As I mentioned above, this is hardcoded inside the source code. There is no specific reason for why we chose 0775 in the beginning.
I will address this as soon as possible!
from tusd.
Related Issues (20)
- validating video files using blocking hooks HOT 4
- Support for managed identity for Azure blob storage HOT 1
- AzureService is using a deprecated SDK (github.com/Azure/azure-storage-blob-go/azblob) HOT 1
- hooks: Hooks continue failing after plugin crashes
- Getting error about part sizes with Cloudflare R2 bucket HOT 3
- Up to date Golang client? HOT 3
- While passing s3Client to s3store.New getting an error named missing method AbortMultipartUploadWithContext HOT 2
- Return 4xx errors from Hooks as 4xx errors. HOT 3
- Best way to pass a server variable to the JS client HOT 3
- How to delete files uploaded to server? HOT 1
- Duplicate id printing in log HOT 1
- `InternalServerError: no such file or directory` when Downloading file with using File Locker. HOT 1
- Extract ID from Path is broken if base path is provided HOT 6
- s3store: unable to create multipart upload HOT 1
- Example haproxy config HOT 11
- Local storage - folder hierarchy HOT 4
- Checking current usage vs limit using /quota endpoint. HOT 3
- FileInfoChanges set in PreFinishHook not available in PostFinishHook HOT 2
- Is lockUpload really needed for HEAD? HOT 5
- Proxy for HTTP/3? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tusd.