Is it possible let MediaWiki hint the browser about the filename and change the content type?
I have a wikipage, e.g., "Buss-Durkee Hostility Inventory". If I save this page from the browser "Buss-Durkee_Hostility_Inventory.html" is suggested as the filename, - which is fine.
I have another wikipage called "Bipolar Disorder Neuroimaging Database - Amygdala.csv". When I download this page (from a template-constructed link) with "/w/index.php?action=raw&title=" I get the filename suggested as "index.php". I would like to have the filename as "Bipolar Disorder Neuroimaging Database - Amygdala.csv" and also manipulate the content type, e.g., to "Content-type: text/csv; charset=utf-8".
Is that possible?
My only idea would be to write a cgi-script that fetches the wikipage with csv information and forwards it to the user while controlling the content-type.
/Finn
MediaWiki does not permit this because allowing random people to create pages and have them returned to a user with a text/html or other mimetype creates XSS vectors and ways of distributing malware.
~Daniel Friesen (Dantman, Nadir-Seen-Fire) [http://daniel.friesen.name]
On 11-08-10 08:30 AM, Finn Årup Nielsen wrote:
Is it possible let MediaWiki hint the browser about the filename and change the content type?
I have a wikipage, e.g., "Buss-Durkee Hostility Inventory". If I save this page from the browser "Buss-Durkee_Hostility_Inventory.html" is suggested as the filename, - which is fine.
I have another wikipage called "Bipolar Disorder Neuroimaging Database - Amygdala.csv". When I download this page (from a template-constructed link) with "/w/index.php?action=raw&title=" I get the filename suggested as "index.php". I would like to have the filename as "Bipolar Disorder Neuroimaging Database - Amygdala.csv" and also manipulate the content type, e.g., to "Content-type: text/csv; charset=utf-8".
Is that possible?
My only idea would be to write a cgi-script that fetches the wikipage with csv information and forwards it to the user while controlling the content-type.
/Finn
On Wed, 2011-08-10 at 17:39 +0200, Daniel Friesen wrote:
MediaWiki does not permit this because allowing random people to create pages and have them returned to a user with a text/html or other mimetype creates XSS vectors and ways of distributing malware.
Yes, I that is right, but I suppose that "text/csv" mimetype would be safe?
/Finn
~Daniel Friesen (Dantman, Nadir-Seen-Fire) [http://daniel.friesen.name]
On 11-08-10 08:30 AM, Finn Årup Nielsen wrote:
Is it possible let MediaWiki hint the browser about the filename and change the content type?
I have a wikipage, e.g., "Buss-Durkee Hostility Inventory". If I save this page from the browser "Buss-Durkee_Hostility_Inventory.html" is suggested as the filename, - which is fine.
I have another wikipage called "Bipolar Disorder Neuroimaging Database - Amygdala.csv". When I download this page (from a template-constructed link) with "/w/index.php?action=raw&title=" I get the filename suggested as "index.php". I would like to have the filename as "Bipolar Disorder Neuroimaging Database - Amygdala.csv" and also manipulate the content type, e.g., to "Content-type: text/csv; charset=utf-8".
Is that possible?
My only idea would be to write a cgi-script that fetches the wikipage with csv information and forwards it to the user while controlling the content-type.
/Finn
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Finn Årup Nielsen wrote:
On Wed, 2011-08-10 at 17:39 +0200, Daniel Friesen wrote:
MediaWiki does not permit this because allowing random people to create pages and have them returned to a user with a text/html or other mimetype creates XSS vectors and ways of distributing malware.
Yes, I that is right, but I suppose that "text/csv" mimetype would be safe?
/Finn
It _seems_ to be safe, both looking at the Media Type Sniffing specification, and our IEContentAnalyzer rewritten from the dread IE sniffing.
wikitech-l@lists.wikimedia.org