3pp-mirror/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-05-24 21:36:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

🐛 Only allow bitmap images on team and profile photo.

Browse source
This commit is contained in:
Andrey Antukh 2021-03-26 23:38:03 +01:00
parent caf1ef653f
commit 90a51dc44a
3 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
backend/src/app/media.clj
View file

@ -188,8 +188,9 @@
;; --- Utility functions ;; --- Utility functions
(defn validate-media-type (defn validate-media-type
[media-type] ([mtype] (validate-media-type mtype cm/valid-media-types))
(when-not (cm/valid-media-types media-type) ([mtype allowed]
(when-not (contains? allowed mtype)
(ex/raise :type :validation (ex/raise :type :validation
:code :media-type-not-allowed :code :media-type-not-allowed
:hint "Seems like you are uploading an invalid media object"))) :hint "Seems like you are uploading an invalid media object"))))

2
backend/src/app/rpc/mutations/profile.clj
View file

@ -386,8 +386,8 @@
(sv/defmethod ::update-profile-photo (sv/defmethod ::update-profile-photo
[{:keys [pool storage] :as cfg} {:keys [profile-id file] :as params}] [{:keys [pool storage] :as cfg} {:keys [profile-id file] :as params}]
(media/validate-media-type (:content-type file))
(db/with-atomic [conn pool] (db/with-atomic [conn pool]
(media/validate-media-type (:content-type file) #{"image/jpeg" "image/png" "image/webp"})
(let [profile (db/get-by-id conn :profile profile-id) (let [profile (db/get-by-id conn :profile profile-id)
_ (media/run cfg {:cmd :info :input {:path (:tempfile file) _ (media/run cfg {:cmd :info :input {:path (:tempfile file)
:mtype (:content-type file)}}) :mtype (:content-type file)}})

3
backend/src/app/rpc/mutations/teams.clj
View file

@ -255,9 +255,10 @@
(sv/defmethod ::update-team-photo (sv/defmethod ::update-team-photo
[{:keys [pool storage] :as cfg} {:keys [profile-id file team-id] :as params}] [{:keys [pool storage] :as cfg} {:keys [profile-id file team-id] :as params}]
(media/validate-media-type (:content-type file))
(db/with-atomic [conn pool] (db/with-atomic [conn pool]
(teams/check-edition-permissions! conn profile-id team-id) (teams/check-edition-permissions! conn profile-id team-id)
(media/validate-media-type (:content-type file) #{"image/jpeg" "image/png" "image/webp"})
(let [team (teams/retrieve-team conn profile-id team-id) (let [team (teams/retrieve-team conn profile-id team-id)
_ (media/run cfg {:cmd :info :input {:path (:tempfile file) _ (media/run cfg {:cmd :info :input {:path (:tempfile file)
:mtype (:content-type file)}}) :mtype (:content-type file)}})