3pp-mirror/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-05-19 18:26:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

🐛 Properly handle temporal files on user uploads.

Browse source
This commit is contained in:
Andrey Antukh 2021-01-25 16:15:28 +01:00 • committed by Hirunatan
parent a69a35a0b6
commit b2bd4bd694
1 changed files with 12 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

28
backend/src/app/rpc/mutations/media.clj
View file

@ -67,26 +67,18 @@
[info] [info]
(= (:mtype info) "image/svg+xml")) (= (:mtype info) "image/svg+xml"))
;; TODO: we need to properly delete temporary files.
(defn- download-media (defn- download-media
[url] [{:keys [storage] :as cfg} url]
(let [result (http/get! url {:as :byte-array}) (let [result (http/get! url {:as :byte-array})
data (:body result) data (:body result)
content-type (get (:headers result) "content-type") mtype (get (:headers result) "content-type")
format (cm/mtype->format content-type)] format (cm/mtype->format mtype)]
(if (nil? format) (if (nil? format)
(ex/raise :type :validation (ex/raise :type :validation
:code :media-type-not-allowed :code :media-type-not-allowed
:hint "Seems like the url points to an invalid media object.") :hint "Seems like the url points to an invalid media object.")
(let [tempfile (fs/create-tempfile) (sto/put-tmp-object storage {:content (sto/content data)
filename (fs/name tempfile)] :content-type mtype}))))
(with-open [ostream (io/output-stream tempfile)]
(.write ostream data))
{:filename filename
:size (count data)
:tempfile tempfile
:content-type content-type}))))
(defn create-file-media-object (defn create-file-media-object
[{:keys [conn storage svgc] :as cfg} {:keys [id file-id is-local name content] :as params}] [{:keys [conn storage svgc] :as cfg} {:keys [id file-id is-local name content] :as params}]
@ -133,14 +125,18 @@
:opt-un [::id ::name])) :opt-un [::id ::name]))
(sv/defmethod ::create-file-media-object-from-url (sv/defmethod ::create-file-media-object-from-url
[{:keys [pool] :as cfg} {:keys [profile-id file-id url name] :as params}] [{:keys [pool storage] :as cfg} {:keys [profile-id file-id url name] :as params}]
(db/with-atomic [conn pool] (db/with-atomic [conn pool]
(let [file (select-file-for-update conn file-id)] (let [file (select-file-for-update conn file-id)]
(teams/check-edition-permissions! conn profile-id (:team-id file)) (teams/check-edition-permissions! conn profile-id (:team-id file))
(let [content (download-media url) (let [mobj (download-media cfg url)
content {:filename "tempfile"
:size (:size mobj)
:tempfile (-> (sto/get-object-url storage mobj)
(sto/file-url->path))
:content-type (:content-type (meta mobj))}
params' (merge params {:content content params' (merge params {:content content
:name (or name (:filename content))})] :name (or name (:filename content))})]
(-> (assoc cfg :conn conn) (-> (assoc cfg :conn conn)
(create-file-media-object params')))))) (create-file-media-object params'))))))