Helper ⭐️⭐️

GIF upload status update

Forum|Forum|8 years ago
April 11, 2018
22 replies
657 views

Hi everyone,

About two weeks ago, we posted a topic that GIF upload is disabled due to security issues.

Currently we are using an open-source library for this functionality that is causing the security problem. We have already reported this issue to the authors of the library and we will wait for the fix in the coming three months. If there is no fix implemented at their end, we will evaluate the steps we need to take.

In short, we expect this functionality to remain disabled for at least three months. We will follow up closely and update you about the status. If you have any questions, feel free to share it in a comment below.

Topic creation

Show previous replies

Julian

Gainsight Employee ⭐️⭐️⭐️

(Edit: I see Daniel already responded to you 🙂 )

I see what you mean Jurgen, but it is not really about the "how" gifs are being uploaded, as far as I can understand it it's more about how they are being stored and checked...

I like your suggestion however it might not be a good investment to spend time on such a workaround than rather spending it on the actual fix, however I am not techy enough to answer this. :)

old reply:I thought it would be a relatively simple task to "re-enable" the upload, however I learned that it is a bigger task than I (and probably others) expected...

Reason is that there has been a larger number of changes in the meantime when it comes to uploading stuff & security, also our third-party provider of the support of .gifs did some changes to ensure security as well. So it is not a task of merely adding ".gif" to a list of accepted files, as the platform has changed quite a bit in the meantime.

The consequence is that we now need to perform a lot of manual labour in order to make sure that the upload of gifs will work smoothly and, more importantly, do not form a security threat in any way.

Looking at the ticket I can see that the whole investigation part of it has been completed, meaning we know which things in our database and interface need to be touched to get the desired result.

Hope I was able to shed some light in to this. We would have loved to do this quicker, however we do not want to risk anything that could break our / your neck by jumping the gun.

I follow my nose, it always knows