diff options
author | Corey Hulen <corey@hulen.com> | 2015-10-26 12:10:10 -0700 |
---|---|---|
committer | Corey Hulen <corey@hulen.com> | 2015-10-26 12:10:10 -0700 |
commit | 86e3764cbd544c64136d5c34c2b80fb66a0cd4bd (patch) | |
tree | 60b7314ee05b996c60160e490c1dfcc73dc1d8fc | |
parent | 2680b81568ca3f8eac1d5937f85085f1785eb84d (diff) | |
parent | 9635bfdd4f3925b0f6f0873508216824b604ac10 (diff) | |
download | chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.tar.gz chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.tar.bz2 chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.zip |
Merge pull request #1193 from hmhealey/plt798
PLT-798 Prevent image files larger than 4k resolution from being uploaded
-rw-r--r-- | api/file.go | 22 | ||||
-rw-r--r-- | api/user.go | 12 | ||||
-rw-r--r-- | web/react/components/create_post.jsx | 10 | ||||
-rw-r--r-- | web/react/components/user_settings/user_settings_general.jsx | 2 |
4 files changed, 38 insertions, 8 deletions
diff --git a/api/file.go b/api/file.go index 94eea516a..f65be145d 100644 --- a/api/file.go +++ b/api/file.go @@ -52,6 +52,8 @@ const ( RotatedCCW = 6 RotatedCCWMirrored = 7 RotatedCW = 8 + + MaxImageSize = 4096 * 2160 // 4k resolution ) var fileInfoCache *utils.Cache = utils.NewLru(1000) @@ -125,6 +127,21 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) { uid := model.NewId() + if model.IsFileExtImage(filepath.Ext(files[i].Filename)) { + imageNameList = append(imageNameList, uid+"/"+filename) + imageDataList = append(imageDataList, buf.Bytes()) + + // Decode image config first to check dimensions before loading the whole thing into memory later on + config, _, err := image.DecodeConfig(bytes.NewReader(buf.Bytes())) + if err != nil { + c.Err = model.NewAppError("uploadFile", "Unable to upload image file.", err.Error()) + return + } else if config.Width*config.Height > MaxImageSize { + c.Err = model.NewAppError("uploadFile", "Unable to upload image file. File is too large.", err.Error()) + return + } + } + path := "teams/" + c.Session.TeamId + "/channels/" + channelId + "/users/" + c.Session.UserId + "/" + uid + "/" + filename if err := writeFile(buf.Bytes(), path); err != nil { @@ -132,11 +149,6 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) { return } - if model.IsFileExtImage(filepath.Ext(files[i].Filename)) { - imageNameList = append(imageNameList, uid+"/"+filename) - imageDataList = append(imageDataList, buf.Bytes()) - } - encName := utils.UrlEncode(filename) fileUrl := "/" + channelId + "/" + c.Session.UserId + "/" + uid + "/" + encName diff --git a/api/user.go b/api/user.go index 06e5336f1..3796a50ee 100644 --- a/api/user.go +++ b/api/user.go @@ -855,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) { return } + // Decode image config first to check dimensions before loading the whole thing into memory later on + config, _, err := image.DecodeConfig(file) + if err != nil { + c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error()) + return + } else if config.Width*config.Height > MaxImageSize { + c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error()) + return + } + + file.Seek(0, 0) + // Decode image into Image object img, _, err := image.Decode(file) if err != nil { diff --git a/web/react/components/create_post.jsx b/web/react/components/create_post.jsx index b74f1871c..32ee31efe 100644 --- a/web/react/components/create_post.jsx +++ b/web/react/components/create_post.jsx @@ -253,8 +253,14 @@ export default class CreatePost extends React.Component { this.setState({uploadsInProgress: draft.uploadsInProgress, previews: draft.previews}); } handleUploadError(err, clientId) { + let message = err; + if (message && typeof message !== 'string') { + // err is an AppError from the server + message = err.message; + } + if (clientId === -1) { - this.setState({serverError: err}); + this.setState({serverError: message}); } else { const draft = PostStore.getDraft(this.state.channelId); @@ -265,7 +271,7 @@ export default class CreatePost extends React.Component { PostStore.storeDraft(this.state.channelId, draft); - this.setState({uploadsInProgress: draft.uploadsInProgress, serverError: err}); + this.setState({uploadsInProgress: draft.uploadsInProgress, serverError: message}); } } handleTextDrop(text) { diff --git a/web/react/components/user_settings/user_settings_general.jsx b/web/react/components/user_settings/user_settings_general.jsx index 70e559c30..1c8ce3c79 100644 --- a/web/react/components/user_settings/user_settings_general.jsx +++ b/web/react/components/user_settings/user_settings_general.jsx @@ -171,7 +171,7 @@ export default class UserSettingsGeneralTab extends React.Component { }.bind(this), function imageUploadFailure(err) { var state = this.setupInitialState(this.props); - state.serverError = err; + state.serverError = err.message; this.setState(state); }.bind(this) ); |