diff options
author | Julien Veyssier <eneiluj@posteo.net> | 2021-11-02 16:23:03 +0300 |
---|---|---|
committer | Julien Veyssier <eneiluj@posteo.net> | 2022-01-03 12:27:35 +0300 |
commit | 09552deea8c92bf94a15e415f96165536a82dd7c (patch) | |
tree | ea6618ac7061d828b0a57387d71256b84851991b /lib | |
parent | 1fedc8f519caff6e722f963b05460f15ccba1f43 (diff) |
check mime type on upload (client and server side)
Signed-off-by: Julien Veyssier <eneiluj@posteo.net>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/Controller/ImageController.php | 46 |
1 files changed, 40 insertions, 6 deletions
diff --git a/lib/Controller/ImageController.php b/lib/Controller/ImageController.php index e1c6ace3d..0646f4b13 100644 --- a/lib/Controller/ImageController.php +++ b/lib/Controller/ImageController.php @@ -26,15 +26,27 @@ declare(strict_types=1); namespace OCA\Text\Controller; use Exception; +use OCA\Text\AppInfo\Application; use OCP\AppFramework\Http; use OCA\Text\Service\ImageService; use OCP\AppFramework\Controller; use OCP\AppFramework\Http\DataDisplayResponse; use OCP\AppFramework\Http\DataResponse; use OCP\IRequest; +use Psr\Log\LoggerInterface; class ImageController extends Controller { + public const IMAGE_MIME_TYPES = [ + 'image/png', + 'image/jpeg', + 'image/gif', + 'image/x-xbitmap', + 'image/bmp', + 'image/svg+xml', + 'image/webp', + ]; + /** * @var string|null */ @@ -43,15 +55,21 @@ class ImageController extends Controller { * @var ImageService */ private $imageService; + /** + * @var LoggerInterface + */ + private $logger; public function __construct(string $appName, IRequest $request, + LoggerInterface $logger, ImageService $imageService, ?string $userId) { parent::__construct($appName, $request); $this->userId = $userId; $this->imageService = $imageService; $this->request = $request; + $this->logger = $logger; } /** @@ -105,16 +123,24 @@ class ImageController extends Controller { public function uploadImage(int $textFileId): DataResponse { try { $file = $this->request->getUploadedFile('image'); - if ($file !== null && isset($file['tmp_name'], $file['name'])) { + if ($file !== null && isset($file['tmp_name'], $file['name'], $file['type'])) { + if (!in_array($file['type'], self::IMAGE_MIME_TYPES)) { + return new DataResponse(['error' => 'Image type not supported'], Http::STATUS_BAD_REQUEST); + } $newFileContent = file_get_contents($file['tmp_name']); $newFileName = $file['name']; $uploadResult = $this->imageService->uploadImage($textFileId, $newFileName, $newFileContent, $this->userId); - return new DataResponse($uploadResult); + if (isset($uploadResult['error'])) { + return new DataResponse($uploadResult, Http::STATUS_BAD_REQUEST); + } else { + return new DataResponse($uploadResult); + } } else { return new DataResponse(['error' => 'No uploaded file'], Http::STATUS_BAD_REQUEST); } } catch (Exception $e) { - return new DataResponse(['error' => 'Upload error: ' . $e->getMessage()], Http::STATUS_BAD_REQUEST); + $this->logger->error('Upload error: ' . $e->getMessage(), ['app' => Application::APP_NAME]); + return new DataResponse(['error' => 'Upload error'], Http::STATUS_BAD_REQUEST); } } @@ -129,16 +155,24 @@ class ImageController extends Controller { public function uploadImagePublic(?int $textFileId, string $shareToken): DataResponse { try { $file = $this->request->getUploadedFile('image'); - if ($file !== null && isset($file['tmp_name'], $file['name'])) { + if ($file !== null && isset($file['tmp_name'], $file['name'], $file['type'])) { + if (!in_array($file['type'], self::IMAGE_MIME_TYPES)) { + return new DataResponse(['error' => 'Image type not supported'], Http::STATUS_BAD_REQUEST); + } $newFileContent = file_get_contents($file['tmp_name']); $newFileName = $file['name']; $uploadResult = $this->imageService->uploadImagePublic($textFileId, $newFileName, $newFileContent, $shareToken); - return new DataResponse($uploadResult); + if (isset($uploadResult['error'])) { + return new DataResponse($uploadResult, Http::STATUS_BAD_REQUEST); + } else { + return new DataResponse($uploadResult); + } } else { return new DataResponse(['error' => 'No uploaded file'], Http::STATUS_BAD_REQUEST); } } catch (Exception $e) { - return new DataResponse(['error' => 'Upload error: ' . $e->getMessage()], Http::STATUS_BAD_REQUEST); + $this->logger->error('Upload error: ' . $e->getMessage(), ['app' => Application::APP_NAME]); + return new DataResponse(['error' => 'Upload error'], Http::STATUS_BAD_REQUEST); } } |