From 9635bfdd4f3925b0f6f0873508216824b604ac10 Mon Sep 17 00:00:00 2001
From: hmhealey <harrisonmhealey@gmail.com>
Date: Mon, 26 Oct 2015 14:38:46 -0400
Subject: Prevented image files larger than 4k resolution from being uploaded

---
 api/user.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'api/user.go')

diff --git a/api/user.go b/api/user.go
index 06e5336f1..3796a50ee 100644
--- a/api/user.go
+++ b/api/user.go
@@ -855,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Decode image config first to check dimensions before loading the whole thing into memory later on
+	config, _, err := image.DecodeConfig(file)
+	if err != nil {
+		c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error())
+		return
+	} else if config.Width*config.Height > MaxImageSize {
+		c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error())
+		return
+	}
+
+	file.Seek(0, 0)
+
 	// Decode image into Image object
 	img, _, err := image.Decode(file)
 	if err != nil {
-- 
cgit v1.2.3-1-g7c22