Skip to content

fix: add new env variable for allowed file extensions to upload #951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smarcet merged 2 commits into from
May 21, 2026
Merged

fix: add new env variable for allowed file extensions to upload #951

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
39d9804
fix: add new env variable for allowed file extensions to upload
tomrndom May 21, 2026
96796bd
fix: clean console log, adjust extensions prop, add fallback value
tomrndom May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ SPONSOR_USERS_API_URL=https://sponsor-users-api.dev.fnopen.com
SPONSOR_USERS_SCOPES="show-medata/read show-medata/write access-requests/read access-requests/write sponsor-users/read sponsor-users/write groups/read groups/write media-upload/write"
EMAIL_SCOPES="clients/read templates/read templates/write emails/read"
FILE_UPLOAD_SCOPES="files/upload"
FILE_UPLOAD_ALLOWED_EXTENSIONS="pdf,jpg,jpeg,png,ppt,key,pptx"
SPONSOR_PAGES_API_URL=https://sponsor-pages-api.dev.fnopen.com
SPONSOR_PAGES_SCOPES="page-template/read page-template/write show-page/read show-page/write media-upload/read"
SCOPES="profile openid offline_access reports/all ${EMAIL_SCOPES} ${INVENTORY_API_SCOPES} ${FILE_UPLOAD_SCOPES} ${PURCHASES_API_SCOPES} ${SPONSOR_USERS_SCOPES} ${SPONSOR_PAGES_SCOPES} ${DROPBOX_MATERIALIZER_API_SCOPES} ${SCOPES_BASE_REALM}/summits/delete-event ${SCOPES_BASE_REALM}/companies/read ${SCOPES_BASE_REALM}/companies/write ${SCOPES_BASE_REALM}/summits/write ${SCOPES_BASE_REALM}/summits/write-event ${SCOPES_BASE_REALM}/summits/read/all ${SCOPES_BASE_REALM}/summits/read ${SCOPES_BASE_REALM}/summits/publish-event ${SCOPES_BASE_REALM}/members/read ${SCOPES_BASE_REALM}/members/read/me ${SCOPES_BASE_REALM}/speakers/write ${SCOPES_BASE_REALM}/attendees/write ${SCOPES_BASE_REALM}/members/write ${SCOPES_BASE_REALM}/organizations/write ${SCOPES_BASE_REALM}/organizations/read ${SCOPES_BASE_REALM}/summits/write-presentation-materials ${SCOPES_BASE_REALM}/summits/registration-orders/update ${SCOPES_BASE_REALM}/summits/registration-orders/delete ${SCOPES_BASE_REALM}/summits/registration-orders/create/offline ${SCOPES_BASE_REALM}/summits/badge-scans/read ${SCOPES_BASE_REALM}/summits/badge-scans/write config-values/write ${SCOPES_BASE_REALM}/summit-administrator-groups/read ${SCOPES_BASE_REALM}/summit-administrator-groups/write ${SCOPES_BASE_REALM}/summit-media-file-types/read ${SCOPES_BASE_REALM}/summit-media-file-types/write user-roles/write entity-updates/publish ${SCOPES_BASE_REALM}/audit-logs/read filter-criteria/read filter-criteria/write"
Expand Down
7 changes: 6 additions & 1 deletion src/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,10 @@ import LogOutCallbackRoute from "./routes/logout-callback-route";
import AuthButton from "./components/auth-button";
import DefaultRoute from "./routes/default-route";
import { getTimezones } from "./actions/base-actions";
import { LANGUAGE_CODE_LENGTH } from "./utils/constants";
import {
ALLOWED_INVENTORY_IMAGE_FORMATS,
LANGUAGE_CODE_LENGTH
} from "./utils/constants";
import { SentryFallbackFunction } from "./components/SentryErrorComponent";

import "@fontsource/roboto/300.css";
Expand Down Expand Up @@ -103,6 +106,8 @@ window.SENTRY_TRACE_PROPAGATION_TARGETS =
window.CFP_APP_BASE_URL = process.env.CFP_APP_BASE_URL;
window.DROPBOX_MATERIALIZER_API_BASE_URL =
process.env.DROPBOX_MATERIALIZER_API_BASE_URL;
window.FILE_UPLOAD_ALLOWED_EXTENSIONS =
process.env.FILE_UPLOAD_ALLOWED_EXTENSIONS || ALLOWED_INVENTORY_IMAGE_FORMATS;
Comment on lines +109 to +110

@coderabbitai coderabbitai Bot May 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep fallback format/content aligned with the env contract.

This fallback uses ALLOWED_INVENTORY_IMAGE_FORMATS, but .env.example defines a broader CSV list for FILE_UPLOAD_ALLOWED_EXTENSIONS. If the env var is missing, behavior can diverge and the value type may differ from the parser’s expected string contract.

Proposed fix 
+const DEFAULT_FILE_UPLOAD_ALLOWED_EXTENSIONS = [
+  "pdf",
+  ...ALLOWED_INVENTORY_IMAGE_FORMATS
+].join(",");
+
 window.FILE_UPLOAD_ALLOWED_EXTENSIONS =
-  process.env.FILE_UPLOAD_ALLOWED_EXTENSIONS || ALLOWED_INVENTORY_IMAGE_FORMATS;
+  process.env.FILE_UPLOAD_ALLOWED_EXTENSIONS ||
+  DEFAULT_FILE_UPLOAD_ALLOWED_EXTENSIONS;
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/app.js` around lines 109 - 110, The assignment to
window.FILE_UPLOAD_ALLOWED_EXTENSIONS falls back to
ALLOWED_INVENTORY_IMAGE_FORMATS which is likely an array, breaking the env
contract that expects a CSV string; update the fallback in the
window.FILE_UPLOAD_ALLOWED_EXTENSIONS assignment so it always yields a CSV
string (e.g. convert ALLOWED_INVENTORY_IMAGE_FORMATS to a comma-separated string
or use the same CSV literal used in .env.example) so downstream parsing receives
a consistent string type.


if (exclusiveSections.hasOwnProperty(process.env.APP_CLIENT_NAME)) {
window.EXCLUSIVE_SECTIONS = exclusiveSections[process.env.APP_CLIENT_NAME];
Expand Down
6 changes: 2 additions & 4 deletions src/pages/sponsors-global/form-templates/sponsor-inventory-popup.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ import {
} from "../../../utils/yup";
import ItemPriceTiers from "../../../components/mui/formik-inputs/item-price-tiers";
import MuiFormikQuantityField from "../../../components/mui/formik-inputs/mui-formik-quantity-field";
import { getFileUploadAllowedExtensions } from "../../../utils/methods";

const SponsorItemDialog = ({
onClose,
Expand Down Expand Up @@ -221,10 +222,7 @@ const SponsorItemDialog = ({
id="image-upload"
name="images"
maxFiles={mediaType.max_uploads_qty}
allowedExtensions={[
"pdf",
...ALLOWED_INVENTORY_IMAGE_FORMATS
]}
allowedExtensions={getFileUploadAllowedExtensions()}
/>
</Grid2>
</Grid2>
Expand Down
8 changes: 3 additions & 5 deletions ...obal/page-templates/page-template-popup/modules/page-template-document-download-module.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,9 @@ import { useField } from "formik";
import { Divider, Grid2, InputLabel } from "@mui/material";
import MuiFormikUpload from "openstack-uicore-foundation/lib/components/mui/formik-inputs/upload";
import MuiFormikTextField from "../../../../../components/mui/formik-inputs/mui-formik-textfield";
import {
ALLOWED_INVENTORY_IMAGE_FORMATS,
PAGE_MODULES_DOWNLOAD
} from "../../../../../utils/constants";
import { PAGE_MODULES_DOWNLOAD } from "../../../../../utils/constants";
import MuiFormikRadioGroup from "../../../../../components/mui/formik-inputs/mui-formik-radio-group";
import { getFileUploadAllowedExtensions } from "../../../../../utils/methods";

const DocumentDownloadModule = ({ baseName, index }) => {
const buildFieldName = (field) => `${baseName}[${index}].${field}`;
Expand Down Expand Up @@ -82,7 +80,7 @@ const DocumentDownloadModule = ({ baseName, index }) => {
id={`document-module-upload-${index}`}
name={buildFieldName("file")}
maxFiles={1}
allowedExtensions={["pdf", ...ALLOWED_INVENTORY_IMAGE_FORMATS]}
allowedExtensions={getFileUploadAllowedExtensions()}
/>
</Grid2>
)}
Expand Down
4 changes: 2 additions & 2 deletions src/pages/sponsors/sponsor-form-item-list-page/components/sponsor-form-item-form.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ import ItemPriceTiers from "../../../../components/mui/formik-inputs/item-price-
import FormikTextEditor from "../../../../components/inputs/formik-text-editor";
import MuiFormikQuantityField from "../../../../components/mui/formik-inputs/mui-formik-quantity-field";
import {
ALLOWED_INVENTORY_IMAGE_FORMATS,
MAX_INVENTORY_IMAGES_UPLOAD_QTY
} from "../../../../utils/constants";
import { getFileUploadAllowedExtensions } from "../../../../utils/methods";

const buildInitialValues = (data) => ({ ...data });

Expand Down Expand Up @@ -151,7 +151,7 @@ const SponsorFormItemForm = ({ initialValues, onSubmit }) => {
id="item-image-upload"
name="images"
maxFiles={MAX_INVENTORY_IMAGES_UPLOAD_QTY}
allowedExtensions={["pdf", ...ALLOWED_INVENTORY_IMAGE_FORMATS]}
allowedExtensions={getFileUploadAllowedExtensions()}
/>
</Box>
</Grid2>
Expand Down
3 changes: 3 additions & 0 deletions src/utils/methods.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -629,3 +629,6 @@ export const formatDate = (date, timeZone, format = DATETIME_FORMAT) => {
.tz(timeZone)
.format(format);
};

export const getFileUploadAllowedExtensions = () =>
window.FILE_UPLOAD_ALLOWED_EXTENSIONS?.split(",").filter(Boolean) ?? [];
Loading