Merge pull request #1101 from TechnologyEnhancedLearning/Develop/Fixes/TD-3727-FileUpload-Vulnerability

swapnamol-abraham · web-flow · commit e04b7afbd22c · 2025-04-29T09:54:11.000+01:00
TD-3727- Unrestricted file upload- SIT comments
diff --git a/LearningHub.Nhs.WebUI/Scripts/vuesrc/contribute/Content.vue b/LearningHub.Nhs.WebUI/Scripts/vuesrc/contribute/Content.vue
@@ -401,7 +401,8 @@
                                                                    v-model.trim="currentPassword"
                                                                    placeholder="Current password"
                                                                    @blur="$v.currentPassword.$touch()"
-                                                                   v-bind:class="{ 'input-validation-error': $v.currentPassword.$error}">
+                                                                   v-bind:class="{ 'input-validation-error': $v.currentPassword.$error}"
+                                                                   @keydown.enter="submitPassword">
                                                         </div>
 
                                                         <div class="row" v-if="showError">
diff --git a/LearningHub.Nhs.WebUI/Scripts/vuesrc/contribute/fileUpload.vue b/LearningHub.Nhs.WebUI/Scripts/vuesrc/contribute/fileUpload.vue
@@ -253,7 +253,7 @@
                             }
                         }
                         else {
-                            this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. The .zip file you tried to upload was empty.');
+                            this.$emit('childfileuploaderror', FileErrorTypeEnum.InvalidType, 'We do not support this file type on the Learning Hub.');
                         }
                     }
                     this.uploading = false;
@@ -263,7 +263,7 @@
                             this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. Please try again and if it still does not upload, contact the support team.');
                         }
                         else {
-                            this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. The .zip file you tried to upload was empty.');
+                            this.$emit('childfileuploaderror', FileErrorTypeEnum.InvalidType, 'We do not support this file type on the Learning Hub.');
                         }                        
                         self.processing = false;
                         self.uploading = false;

Original file line number	Diff line number	Diff line change
`@@ -253,7 +253,7 @@`
`253`	`253`	`}`
`254`	`254`	`}`
`255`	`255`	`else {`
`256`		`- this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. The .zip file you tried to upload was empty.');`
	`256`	`+ this.$emit('childfileuploaderror', FileErrorTypeEnum.InvalidType, 'We do not support this file type on the Learning Hub.');`
`257`	`257`	`}`
`258`	`258`	`}`
`259`	`259`	`this.uploading = false;`
`@@ -263,7 +263,7 @@`
`263`	`263`	`this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. Please try again and if it still does not upload, contact the support team.');`
`264`	`264`	`}`
`265`	`265`	`else {`
`266`		`- this.$emit('childfileuploaderror', FileErrorTypeEnum.Custom, 'There was a problem uploading this file to the Learning Hub. The .zip file you tried to upload was empty.');`
	`266`	`+ this.$emit('childfileuploaderror', FileErrorTypeEnum.InvalidType, 'We do not support this file type on the Learning Hub.');`
`267`	`267`	`}`
`268`	`268`	`self.processing = false;`
`269`	`269`	`self.uploading = false;`