Merge branch 'master' of https://github.com/mattermost/platform into ui-improvements

1 files changed, 13 insertions, 0 deletions

diff --git a/api/user.go b/api/user.go
index 3071e1b26..3796a50ee 100644
--- a/api/user.go
+++ b/api/user.go
@@ -814,6 +814,7 @@ func getProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Cache-Control", "max-age=86400, public") // 24 hrs
 		}
 
+		w.Header().Set("Content-Type", "image/png")
 		w.Write(img)
 	}
 }
@@ -854,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Decode image config first to check dimensions before loading the whole thing into memory later on
+	config, _, err := image.DecodeConfig(file)
+	if err != nil {
+		c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error())
+		return
+	} else if config.Width*config.Height > MaxImageSize {
+		c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error())
+		return
+	}
+
+	file.Seek(0, 0)
+
 	// Decode image into Image object
 	img, _, err := image.Decode(file)
 	if err != nil {