983788 - add a URL-type to attachment UI

Status: RESOLVED DUPLICATE of bug 345504

(Bugzilla :: Attachments & Requests, enhancement)

Description

[Fred Kleindenst]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/32.0.1700.102 Chrome/32.0.1700.102 Safari/537.36

Steps to reproduce:

Clicked an existing attachment link (text attachment) 


Actual results:

either shown text or forced to download (depending on setting)


Expected results:

If the original "text" was a properly formatted URL, (or the UI is modified to have some unique way to input URLs) then the attachment link should follow the URL.

In other words:  create new functionality to support the idea of a "URL attachment".

Comment 1

[Andre Klapper]

What is the usecase here, except for making it easier for spammers that I end up on their malware website? :)

Comment 2

[Fred Kleindenst]

The use case is:

* user has $X megs of stuff to attach.  This exceeds the max attachment limit set by the admin.  
  -- the bugzilla attachment system suggests putting the stuff on another webserver/fileserver and pasting in the URL.
  -- The mechanism to do the pasting (in the attachment system at least) is not very user friendly
  -- the mechanism to retrieve the pasted URL is quite awkward. ( compared to clicking a URL in a comment )

You suggest that a mechanism to handle inputting and presenting URLs would present a possible route for malware links.  This is true.  It is equally true for placing a link in the comments.

Comment 3

[Andre Klapper]

Paste the URL(s) as a comment, problem solved? I think I still fail to see the usecase of putting a URL into a text file and then uploading the text file as an attachment. 
If you want URLs to be clickable, don't use plain text?

Comment 4

[Fred Kleindenst]

Certainly, putting a URL into a comment works.

The use case is specifically about using the attachment mechanism, which has various features like "obsoleting" that are not available in comments

Also, the use case "exceeding the max attachment size" is explicitly messaging the user to paste in a URL ... so maybe that should work well, no?

Comment 5

[Frédéric Buclin]

Following the URL directly is not something we want to do for security reasons, see bug 345504. What we may implement, though, is bug 367651 which would display an intermediate page.