Bug 472206: [SECURITY] Bugzilla should optionally not allow the user to view possibly harmful attachments - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat r=justdave a=LpSolit

1 files changed, 32 insertions, 17 deletions

diff --git a/template/en/default/admin/params/attachment.html.tmpl b/template/en/default/admin/params/attachment.html.tmpl
index 7c0b52472..39f60470e 100644
--- a/template/en/default/admin/params/attachment.html.tmpl
+++ b/template/en/default/admin/params/attachment.html.tmpl
@@ -24,23 +24,38 @@
 %]
 
 [% param_descs = {
-  attachment_base => "It is possible for a malicious attachment to steal your " _
-                     "cookies or access other attachments to perform an attack " _
-                     "on the user.<p>" _
-                     "If you would like additional security on attachments " _
-                     "to avoid this, set this parameter to an alternate URL " _
-                     "for your $terms.Bugzilla that is not the same as " _
-                     "<tt>urlbase</tt> or <tt>sslbase</tt>. That is, a different " _
-                     "domain name that resolves to this exact same $terms.Bugzilla " _
-                     "installation.<p>" _
-                     "For added security, you can insert <tt>%bugid%</tt> into " _
-                     "the URL, which will be replaced with the ID of the current " _
-                     "$terms.bug that the attachment is on, when you access " _
-                     "an attachment. This will limit attachments to accessing " _
-                     "only other attachments on the same ${terms.bug}. " _
-                     "Remember, though, that all those possible domain names " _
-                     "(such as <tt>1234.your.domain.com</tt>) must point to " _
-                     "this same $terms.Bugzilla instance."
+  allow_attachment_display =>
+    "If this option is on, users will be able to view attachments from"
+    _ " their browser, if their browser supports the attachment's MIME type."
+    _ " If this option is off, users are forced to download attachments,"
+    _ " even if the browser is able to display them."
+    _ "<p>This is a security restriction for installations where untrusted"
+    _ " users may upload attachments that could be potentially damaging if"
+    _ " viewed directly in the browser.</p>"
+    _ "<p>It is highly recommended that you set the <tt>attachment_base</tt>"
+    _ " parameter if you turn this parameter on.",
+
+  attachment_base => 
+    "When the <tt>allow_attachment_display</tt> parameter is on, it is "
+    _ " possible for a malicious attachment to steal your cookies or"
+    _ " perform an attack on $terms.Bugzilla using your credentials."
+    _ "<p>If you would like additional security on attachments to avoid"
+    _ " this, set this parameter to an alternate URL for your $terms.Bugzilla"
+    _ " that is not the same as <tt>urlbase</tt> or <tt>sslbase</tt>."
+    _ " That is, a different domain name that resolves to this exact"
+    _ " same $terms.Bugzilla installation.</p>"
+    _ "<p>Note that if you have set the"
+    _ " <a href=\"editparams.cgi?section=core#cookiedomain\"><tt>cookiedomain</tt>"
+    _" parameter</a>, you should set <tt>attachment_base</tt> to use a"
+    _ " domain that would <em>not</em> be matched by"
+    _ " <tt>cookiedomain</tt>.</p>"
+    _ "<p>For added security, you can insert <tt>%bugid%</tt> into the URL,"
+    _ " which will be replaced with the ID of the current $terms.bug that"
+    _ " the attachment is on, when you access an attachment. This will limit"
+    _ " attachments to accessing only other attachments on the same"
+    _ " ${terms.bug}. Remember, though, that all those possible domain names "
+    _ " (such as <tt>1234.your.domain.com</tt>) must point to this same"
+    _ " $terms.Bugzilla instance.",
 
   allow_attachment_deletion => "If this option is on, administrators will be able to delete " _
                                "the content of attachments.",