Merge branch 'master' of https://github.com/mattermost/platform into ui-improvements

1 files changed, 17 insertions, 5 deletions

diff --git a/api/file.go b/api/file.go
index 94eea516a..f65be145d 100644
--- a/api/file.go
+++ b/api/file.go
@@ -52,6 +52,8 @@ const (
 	RotatedCCW         = 6
 	RotatedCCWMirrored = 7
 	RotatedCW          = 8
+
+	MaxImageSize = 4096 * 2160 // 4k resolution
 )
 
 var fileInfoCache *utils.Cache = utils.NewLru(1000)
@@ -125,6 +127,21 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) {
 
 		uid := model.NewId()
 
+		if model.IsFileExtImage(filepath.Ext(files[i].Filename)) {
+			imageNameList = append(imageNameList, uid+"/"+filename)
+			imageDataList = append(imageDataList, buf.Bytes())
+
+			// Decode image config first to check dimensions before loading the whole thing into memory later on
+			config, _, err := image.DecodeConfig(bytes.NewReader(buf.Bytes()))
+			if err != nil {
+				c.Err = model.NewAppError("uploadFile", "Unable to upload image file.", err.Error())
+				return
+			} else if config.Width*config.Height > MaxImageSize {
+				c.Err = model.NewAppError("uploadFile", "Unable to upload image file. File is too large.", err.Error())
+				return
+			}
+		}
+
 		path := "teams/" + c.Session.TeamId + "/channels/" + channelId + "/users/" + c.Session.UserId + "/" + uid + "/" + filename
 
 		if err := writeFile(buf.Bytes(), path); err != nil {
@@ -132,11 +149,6 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		if model.IsFileExtImage(filepath.Ext(files[i].Filename)) {
-			imageNameList = append(imageNameList, uid+"/"+filename)
-			imageDataList = append(imageDataList, buf.Bytes())
-		}
-
 		encName := utils.UrlEncode(filename)
 
 		fileUrl := "/" + channelId + "/" + c.Session.UserId + "/" + uid + "/" + encName