3b5e8524aa
r=kiko r=mkanat r=mrbball a=LpSolit git-svn-id: svn://10.0.0.236/trunk@263258 18797224-902f-48f8-a5cc-f745e15eee43
63 lines
3.5 KiB
Cheetah
63 lines
3.5 KiB
Cheetah
[%# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
#
|
|
# This Source Code Form is "Incompatible With Secondary Licenses", as
|
|
# defined by the Mozilla Public License, v. 2.0.
|
|
#%]
|
|
[%
|
|
title = "Attachments"
|
|
desc = "Set up attachment options"
|
|
%]
|
|
|
|
[% param_descs = {
|
|
allow_attachment_display =>
|
|
"If this option is on, users will be able to view attachments from"
|
|
_ " their browser, if their browser supports the attachment's MIME type."
|
|
_ " If this option is off, users are forced to download attachments,"
|
|
_ " even if the browser is able to display them."
|
|
_ "<p>This is a security restriction for installations where untrusted"
|
|
_ " users may upload attachments that could be potentially damaging if"
|
|
_ " viewed directly in the browser.</p>"
|
|
_ "<p>It is highly recommended that you set the <tt>attachment_base</tt>"
|
|
_ " parameter if you turn this parameter on.",
|
|
|
|
attachment_base =>
|
|
"When the <tt>allow_attachment_display</tt> parameter is on, it is "
|
|
_ " possible for a malicious attachment to steal your cookies or"
|
|
_ " perform an attack on $terms.Bugzilla using your credentials."
|
|
_ "<p>If you would like additional security on attachments to avoid"
|
|
_ " this, set this parameter to an alternate URL for your $terms.Bugzilla"
|
|
_ " that is not the same as <tt>urlbase</tt> or <tt>sslbase</tt>."
|
|
_ " That is, a different domain name that resolves to this exact"
|
|
_ " same $terms.Bugzilla installation.</p>"
|
|
_ "<p>Note that if you have set the"
|
|
_ " <a href=\"editparams.cgi?section=advanced#cookiedomain_desc\"><tt>cookiedomain</tt>"
|
|
_" parameter</a>, you should set <tt>attachment_base</tt> to use a"
|
|
_ " domain that would <em>not</em> be matched by"
|
|
_ " <tt>cookiedomain</tt>.</p>"
|
|
_ "<p>For added security, you can insert <tt>%bugid%</tt> into the URL,"
|
|
_ " which will be replaced with the ID of the current $terms.bug that"
|
|
_ " the attachment is on, when you access an attachment. This will limit"
|
|
_ " attachments to accessing only other attachments on the same"
|
|
_ " ${terms.bug}. Remember, though, that all those possible domain names "
|
|
_ " (such as <tt>1234.your.domain.com</tt>) must point to this same"
|
|
_ " $terms.Bugzilla instance.",
|
|
|
|
allow_attachment_deletion => "If this option is on, administrators will be able to delete " _
|
|
"the content of attachments.",
|
|
|
|
maxattachmentsize => "The maximum size (in kilobytes) of attachments to be stored " _
|
|
"in the database. If a file larger than this size is attached " _
|
|
"to ${terms.abug}, $terms.Bugzilla will look at the " _
|
|
"<a href='#maxlocalattachment'><tt>maxlocalattachment</tt> parameter</a> " _
|
|
"to determine if the file can be stored locally on the web server. " _
|
|
"If the file size exceeds both limits, then the attachment is rejected. " _
|
|
"Settings both parameters to 0 will prevent attaching files to ${terms.bugs}.",
|
|
|
|
maxlocalattachment => "The maximum size (in megabytes) of attachments to be stored " _
|
|
"locally on the web server. If set to a value lower than the " _
|
|
"<a href='#maxattachmentsize'><tt>maxattachmentsize</tt> parameter</a>, " _
|
|
"attachments will never be kept on the local filesystem." }
|
|
%]
|