1 files changed, 64 insertions, 0 deletions

diff --git a/api/post.go b/api/post.go
index 2d25f7ab0..f96320639 100644
--- a/api/post.go
+++ b/api/post.go
@@ -11,6 +11,7 @@ import (
 	"github.com/mattermost/platform/store"
 	"github.com/mattermost/platform/utils"
 	"net/http"
+	"net/url"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -160,6 +161,39 @@ func CreatePost(c *Context, post *model.Post, doUpdateLastViewed bool) (*model.P
 
 	post.UserId = c.Session.UserId
 
+	if len(post.Filenames) > 0 {
+		doRemove := false
+		for i := len(post.Filenames) - 1; i >= 0; i-- {
+			path := post.Filenames[i]
+
+			doRemove = false
+			if model.UrlRegex.MatchString(path) {
+				continue
+			} else if model.PartialUrlRegex.MatchString(path) {
+				matches := model.PartialUrlRegex.FindAllStringSubmatch(path, -1)
+				if len(matches) == 0 || len(matches[0]) < 4 {
+					doRemove = true
+				}
+
+				channelId := matches[0][1]
+				if channelId != post.ChannelId {
+					doRemove = true
+				}
+
+				userId := matches[0][2]
+				if userId != post.UserId {
+					doRemove = true
+				}
+			} else {
+				doRemove = true
+			}
+			if doRemove {
+				l4g.Error("Bad filename discarded, filename=%v", path)
+				post.Filenames = append(post.Filenames[:i], post.Filenames[i+1:]...)
+			}
+		}
+	}
+
 	var rpost *model.Post
 	if result := <-Srv.Store.Post().Save(post); result.Err != nil {
 		return nil, result.Err
@@ -374,6 +408,36 @@ func fireAndForgetNotifications(post *model.Post, teamId, siteURL string) {
 					bodyPage.Props["PostMessage"] = model.ClearMentionTags(post.Message)
 					bodyPage.Props["TeamLink"] = teamURL + "/channels/" + channel.Name
 
+					// attempt to fill in a message body if the post doesn't have any text
+					if len(strings.TrimSpace(bodyPage.Props["PostMessage"])) == 0 && len(post.Filenames) > 0 {
+						// extract the filenames from their paths and determine what type of files are attached
+						filenames := make([]string, len(post.Filenames))
+						onlyImages := true
+						for i, filename := range post.Filenames {
+							var err error
+							if filenames[i], err = url.QueryUnescape(filepath.Base(filename)); err != nil {
+								// this should never error since filepath was escaped using url.QueryEscape
+								filenames[i] = filepath.Base(filename)
+							}
+
+							ext := filepath.Ext(filename)
+							onlyImages = onlyImages && model.IsFileExtImage(ext)
+						}
+						filenamesString := strings.Join(filenames, ", ")
+
+						var attachmentPrefix string
+						if onlyImages {
+							attachmentPrefix = "Image"
+						} else {
+							attachmentPrefix = "File"
+						}
+						if len(post.Filenames) > 1 {
+							attachmentPrefix += "s"
+						}
+
+						bodyPage.Props["PostMessage"] = fmt.Sprintf("%s: %s sent", attachmentPrefix, filenamesString)
+					}
+
 					if err := utils.SendMail(profileMap[id].Email, subjectPage.Render(), bodyPage.Render()); err != nil {
 						l4g.Error("Failed to send mention email successfully email=%v err=%v", profileMap[id].Email, err)
 					}