IQSS / IQSS/dataverse

Feature Request: Disable possibility of modifying the files extensions

Open
#10,067 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Feature: File Upload & Handling Type: Suggestion User Role: Superuser
Dominant language
Java
Stars
1.1k
Forks
564
Avg merge
2d 2h
Merged PRs (30d)
29

Description

Overview of the Feature Request
As an installation admin, I can be sure that the extensions of the deposited files remain unchanged by the user, in order to avoid mischievous deposits "smuggled" passed file extension filters (see related issues).

What kind of user is the feature intended for?
(Example users roles: API User, Curator, Depositor, Guest, Superuser, Sysadmin)
Depositors are affected as they are prevented from editing their files extensions (which also avoids typos),
but the main target benefiting the feature are the installation admins.

What inspired the request?
Discussion about issue :
https://github.com/IQSS/dataverse/issues/10006
and potential ways to bypass such filter.

What existing behavior do you want changed?
When renaming files (API or UI), not being allowed to change the extensions of the files.

Any open or closed issues related to this feature request?
This issue is originated from the discussion in this issue:

  • #7956
    This issue is a step towards this issue :
  • #10006

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the existing file-renaming paths in the API and UI, then read related issues #10006 and #7956 for the security context and expected behavior. Done means depositors cannot change file extensions through either rename path while permitted renaming behavior remains available.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, frontend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.