diff options
| author | Corey Hulen <corey@hulen.com> | 2015-10-26 12:10:10 -0700 |
|---|---|---|
| committer | Corey Hulen <corey@hulen.com> | 2015-10-26 12:10:10 -0700 |
| commit | 86e3764cbd544c64136d5c34c2b80fb66a0cd4bd (patch) | |
| tree | 60b7314ee05b996c60160e490c1dfcc73dc1d8fc /api/user.go | |
| parent | 2680b81568ca3f8eac1d5937f85085f1785eb84d (diff) | |
| parent | 9635bfdd4f3925b0f6f0873508216824b604ac10 (diff) | |
| download | chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.tar.gz chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.tar.bz2 chat-86e3764cbd544c64136d5c34c2b80fb66a0cd4bd.zip | |
Merge pull request #1193 from hmhealey/plt798
PLT-798 Prevent image files larger than 4k resolution from being uploaded
Diffstat (limited to 'api/user.go')
| -rw-r--r-- | api/user.go | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/api/user.go b/api/user.go index 06e5336f1..3796a50ee 100644 --- a/api/user.go +++ b/api/user.go @@ -855,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) { return } + // Decode image config first to check dimensions before loading the whole thing into memory later on + config, _, err := image.DecodeConfig(file) + if err != nil { + c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error()) + return + } else if config.Width*config.Height > MaxImageSize { + c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error()) + return + } + + file.Seek(0, 0) + // Decode image into Image object img, _, err := image.Decode(file) if err != nil { |