Cavemanon
/
cavepaintings
6
0
Fork 2
Code Issues 2 Pull Requests Projects Releases Wiki Activity

Merge pull request #907 from tegaki-tegaki/feature/check_mime_on_upload 

implement MIME checks on upload
This commit is contained in:
Shish 2023-05-25 13:31:51 +01:00 committed by GitHub
parent ac29324184 2882bffe35
commit 85a5ed2dd6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ext/transcode/main.php
View File

@ -167,6 +167,18 @@ class TranscodeImage extends Extension
{
global $config;
// this onDataUpload happens earlier (or could happen earlier) than handle_pixel.onDataUpload
// it mutates the image such that the incorrect mime type is not checked (checking against
// the post-transcode mime type instead). This is to give user feedback on what the mime type
// was before potential transcoding (the original) at the time of upload, and that it failed if not allowed.
// does it break bulk image importing? ZIP? SVG? there are a few flows that are untested!
if ($config->get_bool(UploadConfig::MIME_CHECK_ENABLED) == true) {
$allowed_mimes = $config->get_array(UploadConfig::ALLOWED_MIME_STRINGS);
if (!MimeType::matches_array($event->mime, $allowed_mimes)) {
throw new UploadException("MIME type not supported: " . $event->mime);
}
}
if ($config->get_bool(TranscodeConfig::UPLOAD) == true) {
if ($event->mime === MimeType::GIF&&MimeType::is_animated_gif($event->tmpname)) {
return;

2
ext/upload/config.php
View File

@ -11,4 +11,6 @@ class UploadConfig
public const MIN_FREE_SPACE = "upload_min_free_space";
public const TLSOURCE = "upload_tlsource";
public const TRANSLOAD_ENGINE = "transload_engine";
public const MIME_CHECK_ENABLED = "mime_check_enabled";
public const ALLOWED_MIME_STRINGS = "allowed_mime_strings";
}

19
ext/upload/main.php
View File

@ -98,6 +98,12 @@ class Upload extends Extension
}
}
}
$config->set_default_bool(UploadConfig::MIME_CHECK_ENABLED, false);
$config->set_default_array(
UploadConfig::ALLOWED_MIME_STRINGS,
DataHandlerExtension::get_all_supported_mimes()
);
}
public function onSetupBuilding(SetupBuildingEvent $event)
@ -119,8 +125,21 @@ class Upload extends Extension
$sb->add_label("<i>PHP Limit = " . ini_get('upload_max_filesize') . "</i>");
$sb->add_choice_option(UploadConfig::TRANSLOAD_ENGINE, $tes, "<br/>Transload: ");
$sb->add_bool_option(UploadConfig::TLSOURCE, "<br/>Use transloaded URL as source if none is provided: ");
$sb->start_table();
$sb->add_bool_option(UploadConfig::MIME_CHECK_ENABLED, "Enable upload MIME checks", true);
$sb->add_multichoice_option(UploadConfig::ALLOWED_MIME_STRINGS, $this->get_mime_options(), "Allowed MIME uploads", true);
$sb->end_table();
}
private function get_mime_options(): array
{
$output = [];
foreach (DataHandlerExtension::get_all_supported_mimes() as $mime) {
$output[MimeMap::get_name_for_mime($mime)] = $mime;
}
return $output;
}
public function onPageNavBuilding(PageNavBuildingEvent $event)
{