From 73e6f74edfed0a2dda1ccc3d6d60128a9c607c10 Mon Sep 17 00:00:00 2001 From: Florian Orben Date: Sun, 25 Oct 2015 18:02:36 +0100 Subject: Set correct mime type for profile images --- api/user.go | 1 + 1 file changed, 1 insertion(+) (limited to 'api/user.go') diff --git a/api/user.go b/api/user.go index 3071e1b26..06e5336f1 100644 --- a/api/user.go +++ b/api/user.go @@ -814,6 +814,7 @@ func getProfileImage(c *Context, w http.ResponseWriter, r *http.Request) { w.Header().Set("Cache-Control", "max-age=86400, public") // 24 hrs } + w.Header().Set("Content-Type", "image/png") w.Write(img) } } -- cgit v1.2.3-1-g7c22 From 9635bfdd4f3925b0f6f0873508216824b604ac10 Mon Sep 17 00:00:00 2001 From: hmhealey Date: Mon, 26 Oct 2015 14:38:46 -0400 Subject: Prevented image files larger than 4k resolution from being uploaded --- api/user.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'api/user.go') diff --git a/api/user.go b/api/user.go index 06e5336f1..3796a50ee 100644 --- a/api/user.go +++ b/api/user.go @@ -855,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) { return } + // Decode image config first to check dimensions before loading the whole thing into memory later on + config, _, err := image.DecodeConfig(file) + if err != nil { + c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error()) + return + } else if config.Width*config.Height > MaxImageSize { + c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error()) + return + } + + file.Seek(0, 0) + // Decode image into Image object img, _, err := image.Decode(file) if err != nil { -- cgit v1.2.3-1-g7c22