Feed Sign in with OpenID OpenID

Simon Willison’s Weblog

sorl-thumbnail. This looks like a decent attempt at a generic Django thumbnailing service, but I’m always wary of code that allows URL hackers to create large numbers of files that will be cached to disk. UPDATE: My mistake, thumbnail creation can only be caused by template authors.

Tagged , , , ,

5 comments

  1. URL hacker can not force create new files, only template authors can. Or am I missing something?

    Amit Upadhyay - 27th November 2007 20:40 - #

  2. Good catch, I've posted an update.

    Simon Willison - 27th November 2007 21:05 - #

  3. Thanks for the post about my thumbnail templatetag! I have made some recent updates in order to comply with django guidelines on errors and filter + some minor fixes. Please comment on the google code page about feature requests and other design discussions.

    Mikko - 28th November 2007 16:20 - #

  4. One thing I couldn't see - what about cache invalidation? Such that if someone uploads a replacement image the thumbnail will (eventually) update to reflect it.

    It may be there and I missed it...

    Peter Bowyer - 30th November 2007 09:32 - #

  5. It checks to see if file modification time is newer than thumbnail, if so then it creates a new thumbnail, there is another problem with this however, browser/webserver cache, but that applies to the original image too.

    Mikko - 30th November 2007 12:10 - #

Sign in with OpenID

Auto-HTML: Line breaks are preserved; URLs will be converted in to links.

Manual XHTML: Enter your own, valid XHTML. Allowed tags are a, p, blockquote, ul, ol, li, dl, dt, dd, em, strong, dfn, code, q, samp, kbd, var, cite, abbr, acronym, sub, sup, br, pre

A django site