Keith SmithandClaude Sonnet 4.5 5d9c901918 Fix HIGH Security Issue: Add file upload validation for avatars ...

Added comprehensive validation for avatar file uploads to prevent malicious file uploads.

Validation Checks:
- File extension: Only allow jpg, jpeg, png, gif
- File size: Maximum 5MB
- Content type: Verify MIME type matches allowed image types

Changes:

users/serializers.py:
- Added MAX_AVATAR_SIZE constant (5MB)
- Created validate_avatar() method in UserSerializer
- Validates file extension against whitelist
- Checks file size and provides helpful error messages
- Verifies content-type header matches allowed image types

config/settings/base.py:
- Added FILE_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Added DATA_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Enforces global upload limits at Django level

Security impact:
- Prevents upload of executables, malware, or scripts
- Mitigates DoS via large file uploads
- Ensures only valid image files can be uploaded
- Protects against MIME-type confusion attacks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-23 06:23:11 -07:00

..

settings

Fix HIGH Security Issue: Add file upload validation for avatars

2025-12-23 06:23:11 -07:00

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

asgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

celery.py

Fix Critical Security Issue: Replace print() with proper logging

2025-12-22 22:34:57 -07:00

urls.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

wsgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00