Internal
Public Access
Keith SmithandClaude Sonnet 4.5
5d9c901918
Added comprehensive validation for avatar file uploads to prevent malicious file uploads. Validation Checks: - File extension: Only allow jpg, jpeg, png, gif - File size: Maximum 5MB - Content type: Verify MIME type matches allowed image types Changes: users/serializers.py: - Added MAX_AVATAR_SIZE constant (5MB) - Created validate_avatar() method in UserSerializer - Validates file extension against whitelist - Checks file size and provides helpful error messages - Verifies content-type header matches allowed image types config/settings/base.py: - Added FILE_UPLOAD_MAX_MEMORY_SIZE = 5MB - Added DATA_UPLOAD_MAX_MEMORY_SIZE = 5MB - Enforces global upload limits at Django level Security impact: - Prevents upload of executables, malware, or scripts - Mitigates DoS via large file uploads - Ensures only valid image files can be uploaded - Protects against MIME-type confusion attacks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>