{"action":"created","issue":{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1239","labels_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1239/labels{/name}","comments_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1239/comments","events_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1239/events","html_url":"https://github.com/globaleaks/GlobaLeaks/issues/1239","id":69827019,"number":1239,"title":"File upload description fields should be properly re-implemented","user":{"login":"evilaliv3","id":217034,"avatar_url":"https://avatars.githubusercontent.com/u/217034?v=3","gravatar_id":"","url":"https://api.github.com/users/evilaliv3","html_url":"https://github.com/evilaliv3","followers_url":"https://api.github.com/users/evilaliv3/followers","following_url":"https://api.github.com/users/evilaliv3/following{/other_user}","gists_url":"https://api.github.com/users/evilaliv3/gists{/gist_id}","starred_url":"https://api.github.com/users/evilaliv3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilaliv3/subscriptions","organizations_url":"https://api.github.com/users/evilaliv3/orgs","repos_url":"https://api.github.com/users/evilaliv3/repos","events_url":"https://api.github.com/users/evilaliv3/events{/privacy}","received_events_url":"https://api.github.com/users/evilaliv3/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/C:%20GLBackend","name":"C: GLBackend","color":"02e10c"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/C:%20GLClient","name":"C: GLClient","color":"d7e102"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/F:%20Submission","name":"F: Submission","color":"bfd4f2"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/F:%20UserInterface","name":"F: UserInterface","color":"006b75"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/refactoring","name":"refactoring","color":"333333"}],"state":"open","locked":false,"assignee":{"login":"evilaliv3","id":217034,"avatar_url":"https://avatars.githubusercontent.com/u/217034?v=3","gravatar_id":"","url":"https://api.github.com/users/evilaliv3","html_url":"https://github.com/evilaliv3","followers_url":"https://api.github.com/users/evilaliv3/followers","following_url":"https://api.github.com/users/evilaliv3/following{/other_user}","gists_url":"https://api.github.com/users/evilaliv3/gists{/gist_id}","starred_url":"https://api.github.com/users/evilaliv3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilaliv3/subscriptions","organizations_url":"https://api.github.com/users/evilaliv3/orgs","repos_url":"https://api.github.com/users/evilaliv3/repos","events_url":"https://api.github.com/users/evilaliv3/events{/privacy}","received_events_url":"https://api.github.com/users/evilaliv3/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-04-21T12:07:28Z","updated_at":"2015-04-21T15:49:43Z","closed_at":null,"body":"Since the token addition implemented in relation to D8 a file uploads does not get any db-id until the submission is finalized.\r\n\r\nthis means that no db-id is usable as key reference between a submission field of kind file upload and the file itself so that the following action should be taken:\r\n\r\n- short term fix: current code related to file upload fields (e.g. the descriptions by the user) should be removed/disabled.\r\n- long term fix: a unique identifier should be associated to the file and exported by the glbackend API to allow file-description_fields association; basically this could be implemented with a random sequence generated by the backend for each uploaded file and to be stored in the file table when the file metadata is saved from the token memory data stracture to the the db.\r\n\r\n\\cc @vecna @fpietrosanti "},"comment":{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/comments/94848858","html_url":"https://github.com/globaleaks/GlobaLeaks/issues/1239#issuecomment-94848858","issue_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1239","id":94848858,"user":{"login":"evilaliv3","id":217034,"avatar_url":"https://avatars.githubusercontent.com/u/217034?v=3","gravatar_id":"","url":"https://api.github.com/users/evilaliv3","html_url":"https://github.com/evilaliv3","followers_url":"https://api.github.com/users/evilaliv3/followers","following_url":"https://api.github.com/users/evilaliv3/following{/other_user}","gists_url":"https://api.github.com/users/evilaliv3/gists{/gist_id}","starred_url":"https://api.github.com/users/evilaliv3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilaliv3/subscriptions","organizations_url":"https://api.github.com/users/evilaliv3/orgs","repos_url":"https://api.github.com/users/evilaliv3/repos","events_url":"https://api.github.com/users/evilaliv3/events{/privacy}","received_events_url":"https://api.github.com/users/evilaliv3/received_events","type":"User","site_admin":false},"created_at":"2015-04-21T15:49:43Z","updated_at":"2015-04-21T15:49:43Z","body":"i agree on your point that the token alone would limit the dos attack surface but:\r\n\r\n1. since always a file is associated to a tip in order to have automatic cleanup in case a tip is deleted\r\n2. now the tip is created only at tip finalization so that files can be saved and their id generarated only at the end\r\n3. file are saved and the user would have to type file related infos (the description) before 2\r\n\r\n@hellais what is your thinking?"}}