Re: Pasting images versus uploading

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE/NCg7Xf1UydoVFgpGvW31BqCOLMFAl+AD6IACgkQGvW31BqC
OLM7IQgAhEp4dN0eMliCQoj8OGMjiRtCY7se4LwxKcmVlaoFEFTPwxa+Z136x/7Z
lBRHCMEhzjDbI9pXn+O4cnd9nxB5Mg4mtb7gN8e20zzR0v9EjLegVmYRkryTtYeW
j3ujANi+tlBzmicaN8K6q60H7388Mx5NxmE9vZ3POMUJgzCt0aeWqmGk76QRGP4r
VTSKyyQfew5a/gE4cMMHvqg1Vn+hVo1nnqaQClCvTPcJfFOL8z4M1D5LqCWTVLiO
h4f2y9u/buF2Icj4BJyWfQ2uN3tkDMQ6u+7/XDBZj+sfNKWpuQZAfZXT2HAmhgDy
bQRn42/S8LfyOQQ6kYPbtRRBQusBbg==
=2utw
-----END PGP SIGNATURE-----
On 9/10/2020 11:55 am, Ryan Nowakowski wrote:
> Maybe you could swap out the default ImageField widget for
> TinyMCE-lite HTMLField? Security-wise you probably want to sanitize
> the input from HTMLField in Django to make sure only img tags are allowed.

With the image pasted in, viewing the browser page source it is
represented as just a string although it does contain ...

... src="data:image/png;base64,iVBOR ...


Are you saying all I have to do is write a clean() method for the
HTMLField to detect various image types?

Thanks

Mike

>
> On October 7, 2020 7:02:16 PM CDT, Mike Dewhirst
> <miked@dewhirst.com.au> wrote:
>
> Users need to include an image of a molecular structure in a project I'm
> building. These are small enough that I could limit the size without
> restricting functionality. The image needs to be printed out for a report.
>
> What is the best approach?
>
> I have implemented a TinyMCE-lite HTMLField which accepts a pasted image
> and in other systems I have used a Django ImageField for uploading.
> ImageField is obviously easier on database size but pasting is easier on
> the users.
>
> I'm keen to make the UI easier (by pasting) but I worry it is a
> vulnerability if abused.
>
> Thanks for any advice
>
> Cheers
>
> Mike
>
> -- You received this message because you are subscribed to the Google
> Groups "Django users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to django-users+unsubscribe@googlegroups.com
> <mailto:django-users+unsubscribe@googlegroups.com>.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/django-users/0F5DF089-E571-4730-9D46-7DD41216F4D4%40fattuba.com
> <https://groups.google.com/d/msgid/django-users/0F5DF089-E571-4730-9D46-7DD41216F4D4%40fattuba.com?utm_medium=email&utm_source=footer>.


--
Signed email is an absolute defence against phishing. This email has
been signed with my private key. If you import my public key you can
automatically decrypt my signature and be sure it came from me. Just
ask and I'll send it to you. Your email software can handle signing.


--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/3611cc83-8ce8-5ccc-5f15-1463da733e26%40dewhirst.com.au.