CUNY Academic Commons

Ray can probably say more about how the specific message is generated. We do not allow the upload of .ics using the general upload mechanism, and I'm guessing that RBE checks against this allowed-extension list.

Ray, do you see a security issue with allowing .ics files? Given that they are meant to be downloaded and loaded into a calendar application?

A potential point of confusion is that one might believe that uploading an .ics file would have some connection to the group calendar. But this wouldn't work without some further development.

We do not allow the upload of .ics using the general upload mechanism, and I'm guessing that RBE checks against this allowed-extension list.

That's correct. So if we want to allow .ics files for forum attachments, we just need to allow .ics files at the WordPress media library level.

Ray, do you see a security issue with allowing .ics files? Given that they are meant to be downloaded and loaded into a calendar application?

Good point, Boone. My guess is that this would depend on the iCalendar application being used and whether that is vulnerable to exploits. Another tactic is social engineering. The .ics file could contain events with external links to phishing sites in their event description.

However, this last point applies to all document types, not just .ics files. We already allow documents and PDFs, so it should be okay to go ahead with allowing .ics files.

A potential point of confusion is that one might believe that uploading an .ics file would have some connection to the group calendar. But this wouldn't work without some further development.

That's another good point. If we were to do this, we would probably have to limit this to group admins only.