{"action":"created","issue":{"url":"https://api.github.com/repos/dimagi/commcare-hq/issues/14178","repository_url":"https://api.github.com/repos/dimagi/commcare-hq","labels_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/14178/labels{/name}","comments_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/14178/comments","events_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/14178/events","html_url":"https://github.com/dimagi/commcare-hq/pull/14178","id":194624368,"number":14178,"title":"Case import history: phase 2","user":{"login":"dannyroberts","id":137212,"avatar_url":"https://avatars.githubusercontent.com/u/137212?v=3","gravatar_id":"","url":"https://api.github.com/users/dannyroberts","html_url":"https://github.com/dannyroberts","followers_url":"https://api.github.com/users/dannyroberts/followers","following_url":"https://api.github.com/users/dannyroberts/following{/other_user}","gists_url":"https://api.github.com/users/dannyroberts/gists{/gist_id}","starred_url":"https://api.github.com/users/dannyroberts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dannyroberts/subscriptions","organizations_url":"https://api.github.com/users/dannyroberts/orgs","repos_url":"https://api.github.com/users/dannyroberts/repos","events_url":"https://api.github.com/users/dannyroberts/events{/privacy}","received_events_url":"https://api.github.com/users/dannyroberts/received_events","type":"User","site_admin":false},"labels":[{"id":180677609,"url":"https://api.github.com/repos/dimagi/commcare-hq/labels/No%20lint%20errors","name":"No lint errors","color":"bfe5bf","default":false},{"id":79032211,"url":"https://api.github.com/repos/dimagi/commcare-hq/labels/Open%20for%20review:%20hold%20off%20on%20merge","name":"Open for review: hold off on merge","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-12-09T15:32:13Z","updated_at":"2016-12-12T15:28:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/dimagi/commcare-hq/pulls/14178","html_url":"https://github.com/dimagi/commcare-hq/pull/14178","diff_url":"https://github.com/dimagi/commcare-hq/pull/14178.diff","patch_url":"https://github.com/dimagi/commcare-hq/pull/14178.patch"},"body":"- first two commits: make case importer return to landing page when initiated instead of special progress polling page\r\n- the rest: expose original upload file in case import history (allow domain admins to download all of them, allow everyone else to download their own; we can modify the permissions in the future to be more permissive, but wanted something simple that definitely doesn't give anyone access to case data they shouldn't have)\r\n\r\n<img width=\"1188\" alt=\"screen shot 2016-12-09 at 10 31 14 am\" src=\"https://cloud.githubusercontent.com/assets/137212/21054216/b1aa89ba-bdfa-11e6-8fca-4da3b89df6a6.png\">\r\n"},"comment":{"url":"https://api.github.com/repos/dimagi/commcare-hq/issues/comments/266459993","html_url":"https://github.com/dimagi/commcare-hq/pull/14178#issuecomment-266459993","issue_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/14178","id":266459993,"user":{"login":"dannyroberts","id":137212,"avatar_url":"https://avatars.githubusercontent.com/u/137212?v=3","gravatar_id":"","url":"https://api.github.com/users/dannyroberts","html_url":"https://github.com/dannyroberts","followers_url":"https://api.github.com/users/dannyroberts/followers","following_url":"https://api.github.com/users/dannyroberts/following{/other_user}","gists_url":"https://api.github.com/users/dannyroberts/gists{/gist_id}","starred_url":"https://api.github.com/users/dannyroberts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dannyroberts/subscriptions","organizations_url":"https://api.github.com/users/dannyroberts/orgs","repos_url":"https://api.github.com/users/dannyroberts/repos","events_url":"https://api.github.com/users/dannyroberts/events{/privacy}","received_events_url":"https://api.github.com/users/dannyroberts/received_events","type":"User","site_admin":false},"created_at":"2016-12-12T15:28:17Z","updated_at":"2016-12-12T15:28:17Z","body":"> @dannyroberts just ping when you're ready for review. one question I had was whether we should be cognizant of the storage overhead of this change and also of a possible site vulnerability? what happens if i just start spamming 1GB importer uploads?\r\n\r\nthat's a good question. I'll answer the specific example but also curious if you meant something else by site vulnerability like an exploit that takes advantage of us storing any file they give us (in this case, it's only stored once it's been opened as an excel file, if that's any help), or if you just mean a sort of DoS by quickly filling our storage space like the example you mentioned.\r\n\r\nIf we want to guard against that, I can think of a couple options. One is to not allow file uploads over a certain size, but I can see that actually hurting a project if the size is set too low; another option is to only allot some maximum amount of storage for a single domain, and start deleting old upload files once it's exceeded. Or I suppose, both. Are there any other places in the code where this could be a problem that we feel we've addressed it well? The only thing that comes to mind right now is form attachments—do we feel like we've dealt with the similar threat there well?\r\n"}}
{"actor":{"display_login":"dannyroberts"}}