by asmecher » Tue Jul 18, 2006 2:01 pm
Hi Shubhash,
I'll take this into consideration. In my opinion, if the server is identifying CSS as C code using the standard toolsets, the server is mis-configured; I don't know if the text/x-c work-around applies to any situations outside your own. It might be worth relaxing the constraint to add text/plain to the list. In the meantime, if this work-around is correcting the problem for you, go ahead with it -- in future releases, even if we don't incorporate a change like this, using the patch upgrade method will prevent having to re-apply this modification.
Note that only matching the text/ prefix may be a security hole. It's possible, for example, that a user could upload a shell script that the server identifies as text/x-csh. Some web servers use mime types to determine how to handle files, which could result in the script being executed.
Regards,
Alec Smecher
Open Journal Systems Team