MishkaCmsCore.Runtime.Resources.Validations.PageUploads (Mishka CMS Core v0.0.1)

Copy Markdown View Source

Refuses a page whose uploads declares a file field no visitor could use.

A published page is a form an anonymous visitor posts to, so every upload names the types it takes, checked at the action boundary every writer passes — the builder, the page form, the JSON API and a seed alike:

  • accept is required: image/*, .pdf says what is wanted, and nothing says "anything";
  • every type in it is one MishkaCmsCore.Runtime.PageUpload.allowed_types/0 lists. HTML, SVG, XML and script files are never among them, because the site serves what a visitor uploads from its own origin.

A row with no name is left to the compiler, which drops it: a half-filled row is one keystroke away from a finished one.