Add att.full_clean() before saving

Fix issue #983 Also, fix bug stored XSS disclosure: https://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e/
django-helpdesk · Nov 18, 2021 · 04483bd · 04483bd
1 parent 2c7065e
commit 04483bd
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/helpdesk/lib.py b/helpdesk/lib.py
@@ -145,6 +145,7 @@ def process_attachments(followup, attached_files):
                 'application/octet-stream',
                 size=attached.size,
             )
+            att.full_clean()
             att.save()
 
             if attached.size < max_email_attachment_size: