On Sun, Nov 16, 2008 at 3:51 PM, Daniel Kinzler <daniel(a)brightbyte.de> wrote: I was just about to post the same thing, Damiel beat me because I took the time to test the current functionality. We permitted SXD (openoffice 1.x) files until fairly recently when the new Java/zip exploit came to light, up until that point the newer ODT files were just not supported by omission. Now we've been reminded of the problems of zip formats, so we're currently denying both. If someone creates a good sanitizer that only allows normal ODT files without the risk of smuggling hidden program code, then we could allow the OpenOffice files again. I believe it would be desirable to do so, as rejecting the editable form is highly undesirable. Although, we strongly prefer wikitext for text, so there ought to be a very good reason for using ODT *or* PDF. Most uploaded PDFs are deleted and http://commons.wikimedia.org/wiki/Commons:Scope has some to say about the matter. I'll go update the formats page to reflect this information.

On Sun, Nov 16, 2008 at 4:13 PM, Artur Fijałkowski <wiki.warx(a)gmail.com> wrote: Disallow recursive zips (not needed for any of these formats), and check the directory before uncompressing, disallowing anything that decompresses to enormous sizes. The combination should be sufficient for that particular issue.

On Sun, Nov 16, 2008 at 4:42 PM, Lars Aronsson <lars(a)aronsson.se> wrote: What layout there could you not accomplish via Wikitext? Even allowing ODT its use really hurts editability, since we lose many of revision control features of mediawiki for these documents and require users to have a particular software package installed rather than just using the website.

Lars Aronsson wrote: Not that I am aware. That breaks the wiki principle, and it would need special support from the software. Better to allow trusted users to bypass filetype checks and set some process for sending them for upload (after review) those files that "must be uploaded in X format". Those are much easier to validate :) At least they won't steal cookies. Still, we would need to check they don't have embedded objects.

On Mon, Nov 17, 2008 at 4:31 AM, Mohamed Magdy <mohamed.m.k(a)gmail.com> wrote: Ugh. Please do not rely on this. The embedded zip in PDF has been abused to smuggle illegal material into PDFs on commons. We don't block these files right now, but we may someday, and even without blocking they are likely to be confused for something sneaky and get deleted. Once we have proper ODF screening we could possibly allow just those in PDF, but then again, we could allow them directly (which I think would be preferable).

On Mon, Nov 17, 2008 at 9:48 AM, Bryan Tong Minh <bryan.tongminh(a)gmail.com> wrote: The resulting file is not part of the ISO covered part of PDF. Many PDF viewers have no clue how to extract the embedded file. On the site the distinct revision history of the files is lost (i.e. someone could revise the ODF or the PPT and not the other, and you couldn't see that on the site). And, of course size... ODF documents can potentially be very large. Despite those arguments against it, always having the document source in an editable form is, admittedly, very attractive. I don't think that it's worth having a big debate over files which could only be permitted in a fairly sparing manner. In any case, document validation is a pre-req in any case. On Mon, Nov 17, 2008 at 4:12 AM, Lars Aronsson <lars(a)aronsson.se> wrote: [snip] This has already veered off-topic for this list… We operate Wikis here today, our projects are collaborative, and wiki is our only robust collaborative technology. While I do not want to tell you "no" as there are a lot of useful reasons to accept OpenOffice uploads, there are also many reasons why we're fairly restrictive about non-wikitext formatted-text uploads. There is a desire to accommodate real needs— but it needs to be balanced against our desire to maximize accessibility and the ability to collaborate. If wikitext has layout shortcomings which are impacting you, then you should disclose them so that people can think about how to resolve them. But if your position is "I just want to do it my way", then perhaps you should be starting a separate project.

Yes, sad. I think everysone agrees. But not trivial to fix. So, help with fixing it, or wait for someone else to fix it. Complaining doesn't help. Such is the nature of open source projects. -- daniel

On Tue, Nov 18, 2008 at 7:52 AM, Daniel Kinzler <daniel(a)brightbyte.de>wrote;wrote: Sometimes complaining does help, though. And such *is* the nature of open source projects - "given enough eyeballs, all bugs are shallow" is not a statement that "given enough coders, all bugs are fixable". Code is better than complaints, but complaints are better than nothing.

On Tue, Nov 18, 2008 at 4:34 AM, Lars Aronsson <lars(a)aronsson.se> wrote: Who suggested you do so? I was asking you to express your needs in a clear and actionable manner so that *someone* might address them. I looked at the document you provided and with the exception of pagination control I didn't see any obvious layout elements that Wikitext does not provide. I have no doubt that they exist, but I'm missing them. Improvements to Wikitext would be beneficial to many people. The current reasons for not allowing these formats has already been explained by multiple people, they have nothing to do with demanding you to make your own camera. It's mostly not supposed to be, except for some forms of source material. Full of is relative: Out of 3.5 million files ones in that class are fairly infrequent... and posters are not equivalent to text documents. Commons does not generally permit uploads of original texts which could otherwise be wiki-text, though this is not why ODT is not currently allowed. (http://commons.wikimedia.org/wiki/Commons:Scope#Allowable_reasons_for_PDF_a…)

On Mon, Nov 17, 2008 at 12:41 PM, Mohamed Magdy <mohamed.m.k(a)gmail.com> wrote: IPs vandalizing don't take over your accounts and wreak havoc on the sites. Java in Zip has that potential. IPs vandalizing to not result in converting commons into a warez repository will with illicitly copied games, system cracking tools, and other undesirable content being distributed undetected for months/years at a time. Zip in PDF and rar appended PDF have resulted in this. There is a transparency to Wiki which makes open wiki's viable. Text-in-upload lacks that transparency and that leads to problems. We need to strike a good balance. Unscrubbed PDF and ZIP uploads are not an especially good balance.