Oscar 2.0.4 release notes¶
- release
2019-12-05
This is Oscar 2.0.4, a security release.
Security fixes¶
The file handling behaviour of uploaded CSV files for ranges (handled by
RangeProductListView
) has been modified to address a potential security
risk when invalid files are uploaded, as these would previously be left on disk
if parsing of the uploaded file failed.
Uploaded files are no longer written to disk by Oscar, but processed directly from the temporary uploaded file.
This means that RangeProductFileUpload.filepath
no longer stores a
reference to the stored path of an uploaded file, but only its file name for
reporting purposes. The filename
property of RangeProductFileUpload
has been removed.
The RangeProductListView.create_upload_object
,
RangeProductFileUpload.process
and RangeProductFileUpload.extract_ids
methods now both expect a file object as a positional argument.
Projects that have overridden any of these methods will need to make
corresponding changes.
The OSCAR_UPLOAD_ROOT
setting which was used exclusively by this feature has
been removed.
Thanks to Mina Mohsen Edwar for reporting this issue.