Bug importing XML embed instead of href for PDF attachments

[simgiallorosso]

Hello, when importing a native XML file into OJS, it reports an error indicating that on line 47 of the XML file, it complains that to import the PDF, the line

is incorrect. It says to use embed instead of href. This means that, contrary to what is written in the manual (https://docs.pkp.sfu.ca/admin-guide/en/data-import-and-export), it requires the PDF file to be embedded in the XML file by encoding it in base64 instead of providing it as a link to a file published online. We have updated the OJS version to 3.5.0-3 and in my opinion it has a bug. The manual makes no mention of requiring the PDF to be embedded in the XML.
Can you fix this or give us some pointers?

[asmecher]

Hi @simgiallorosso,

Can you include the exact text of the error message you’re receiving?

Regards,
Alec Smecher
Public Knowledge Project Team

[simgiallorosso]

• Web-based imports may not specify “href”; use “embed” instead, or import using the command line.

• The submission’s child submission_file failed to be processed

[asmecher]

Hi @simgiallorosso,

This was an intentional change introduced here:

Import | Permit hrefs only for command-line based imports

The purpose of this change was to prevent XML uploads from being used to arbitrarily initiate connections from the host system – likely behind a firewall – to user-specified URLs.

If you want to specify remote URLs in imports, use the command-line import tool; if you have command-line access, invoking HTTP/HTTPS connections from an import document does not represent an escalation.

Regards,
Alec Smecher
Public Knowledge Project Team

[simgiallorosso]

Perfect, if you can update the documentation on line