Check real mime type when author uploads a file

[geoffreykwan]

When an author uploads a file that they aren't allowed to in the File Manager, they can spoof (manually change) the Content-Type to allow it to be uploaded.

1. Download the Burp Suite Community Edition (no need to enter email, just click "Go straight to downloads")
   https://portswigger.net/burp/communitydownload

2. Install Burp Suite Community Edition

3. Launch Burp Suite Community Edition

4. Leave "Temporary project" selected

   • Click "Next"

5. Use Burp defaults

   • Click "Start Burp"

6. Configure the proxy

   • Click Proxy tab
   • Click Options tab
   • Under Proxy Listeners, highlight the 127.0.0.1:8080 line
   • Click "Edit"
   • Change port from 8080 to 8081

7. Launch the browser

   • Click Intercept tab
   • Click "Open browser"

8. Upload a file that should not be allowed

   • In the Burp browser go to localhost:81
   • Log in as a teacher
   • Open a unit in the Authoring Tool
   • Go to the File Manager view
   • Go back to the Burp application and click "Intercept is off" to turn intercept on
   • Go back to the Burp browser and drag and drop a php file into the File Manager
   • Go back to the Burp application and it should have intercepted the upload request
   • Change
     • Content-Type: application/octet-stream
     • to
     • Content-Type: image/jpeg
   • Click "Forward" button at the top left
   • The file will be uploaded when it shouldn't be

Right now we only look at the Content-Type which can be spoofed. We should try to detect the real mime type instead of relying on the Content-Type value.

[geoffreykwan]

🎉 This issue has been resolved in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀