README.md in file_validators-1.2.0 vs README.md in file_validators-2.0.0
- old
+ new
@@ -13,11 +13,11 @@
## Support
* ActiveModel versions: 3 and 4.
* Rails versions: 3 and 4.
-It has been tested to work with Carrierwave, Paperclip, Dragonfly etc file uploading solutions.
+It has been tested to work with Carrierwave, Paperclip, Dragonfly, Refile etc file uploading solutions.
Validations works both before and after uploads.
## Installation
Add the following to your Gemfile:
@@ -133,11 +133,21 @@
```
```ruby
# proc/lambda example
validates :video, file_content_type: { allow: lambda { |record| record.content_types } }
```
-* `exclude`: Forbidden content types. Can be a single content type or an array. Each type can be a String or a Regexp. It also accepts `proc`. See `:allow` options examples.
+* `exclude`: Forbidden content types. Can be a single content type or an array. Each type
+can be a String or a Regexp. It also accepts `proc`. See `:allow` options examples.
+* `mode`: `:strict` or `:relaxed`. `:strict` mode can detect content type based on the contents
+of the files. It also detects media type spoofing (see more in [security](#security)).
+`:relaxed` mode uses file name to detect the content type using `mime-types` gem.
+If mode option is not set then the validator uses form supplied content type.
+```ruby
+# string
+validates :avatar, file_content_type: { allow: 'image/jpeg', mode: :strict }
+validates :avatar, file_content_type: { allow: 'image/jpeg', mode: :relaxed }
+```
* `message`: The message to display when the uploaded file has an invalid content type.
You will get `types` as a replacement. You can write error messages without using any replacement.
```ruby
validates :avatar, file_content_type: { allow: ['image/jpeg', 'image/gif'],
message: 'only %{types} are allowed' }
@@ -155,19 +165,24 @@
validates :avatar, file_content_type: { allow: /^image\/.*/, exclude: ['image/png', 'image/gif'] }
```
## Security
-This gem uses file command to get the content type based on the content of the file rather
+This gem can use Unix file command to get the content type based on the content of the file rather
than the extension. This prevents fake content types inserted in the request header.
It also prevents file media type spoofing. For example, user may upload a .html document as
a part of the EXIF header of a valid JPEG file. Content type validator will identify its content type
as `image/jpeg` and, without spoof detection, it may pass the validation and be saved as .html document
-thus exposing your application to a security vulnerability. Media type spoof detector wont let that happen. It will not allow a file having `image/jpeg` content type to be saved as `text/plain`. It checks only media type mismatch, for example `text` of `text/plain` and `image` of `image/jpeg`. So it will not prevent `image/jpeg` from saving as `image/png` as both have the same `image` media type.
+thus exposing your application to a security vulnerability. Media type spoof detector wont let that happen.
+It will not allow a file having `image/jpeg` content type to be saved as `text/plain`. It checks only media
+type mismatch, for example `text` of `text/plain` and `image` of `image/jpeg`. So it will not prevent
+`image/jpeg` from saving as `image/png` as both have the same `image` media type.
-**note**: Media type spoof detection is integrated in the [content type validator](#file-content-type-validator). This means without content type validation spoof detection wont be enabled.
+**note**: This security feature is disabled by default. To enable it, first add `cocaine` gem in
+your Gemfile and then add `mode: :strict` option in [content type validations](#file-content-type-validator).
+`:strict` mode may not work in direct file uploading systems as the file is not passed along with the form.
## i18n Translations
File Size Errors
* `file_size_is_in`: takes `min` and `max` as replacements
@@ -208,9 +223,31 @@
kb: "KB"
mb: "MB"
gb: "GB"
tb: "TB"
```
+
+## Further Instructions
+
+If you are using `:strict` or `:relaxed` mode, for content types which are not supported
+by mime-types gem, you need to register those content types. For example, you can register
+`.docx` in the initializer:
+```Ruby
+# config/initializers/mime_types.rb
+Mime::Type.register "application/vnd.openxmlformats-officedocument.wordprocessingml.document", :docx
+```
+
+If you want to see what content type `:strict` mode returns, run this command in the shell:
+```Shell
+$ file -b --mime-type your-file.xxx
+```
+
+## Issues
+
+**Carrierwave** - You are adding file validators to a model, then you are recommended to keep extension_white_list &/
+extension_black_list in the uploaders (in case you don't have, add that method).
+As of this writing (see [issue](https://github.com/carrierwaveuploader/carrierwave/issues/361)), Carrierwave
+uploaders start processing a file immediately after its assignment (even before the validators are called).
## Tests
```ruby
rake