Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to define authorized MIME types in ImageManager::validateUpload() #16316

Merged
merged 8 commits into from Nov 15, 2019
Merged

Allow to define authorized MIME types in ImageManager::validateUpload() #16316

Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f6a5ee5
Permit to override the mime-type list in ImageManager::validateUpload
Progi1984 Nov 7, 2019
906ebd6
Check the mimetype (if the file is not managed by the previous method…
Progi1984 Nov 7, 2019
cd83561
Fixed PhpDoc
Progi1984 Nov 7, 2019
c18d5f7
Extracted function ImageManager::getMimeType
Progi1984 Nov 8, 2019
0fb5477
Fixed PrettyCI
Progi1984 Nov 8, 2019
9f55a2e
Fixed PrettyCI
Progi1984 Nov 8, 2019
22d6ad1
Fixed feedback from @PierreRambaud
Progi1984 Nov 8, 2019
f01ff79
Fixed PrettyCI
Progi1984 Nov 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
17 changes: 11 additions & 6 deletions classes/ImageManager.php
View file
Open in desktop
Expand Up @@ -358,7 +358,7 @@ public static function imagecopyresampled(
*
* @param string $filename File path to check
* @param string $fileMimeType File known mime type (generally from $_FILES)
* @param array $mimeTypeList Allowed MIME types
* @param array<string>|null $mimeTypeList Allowed MIME types
*
* @return bool
*/
Expand All @@ -379,14 +379,17 @@ public static function isRealImage($filename, $fileMimeType = null, $mimeTypeLis
} else {
$fileMimeType = false;
}
} elseif (function_exists('finfo_open')) {
}
if (!$mimeType && function_exists('finfo_open')) {
$const = defined('FILEINFO_MIME_TYPE') ? FILEINFO_MIME_TYPE : FILEINFO_MIME;
Progi1984 marked this conversation as resolved.
Show resolved Hide resolved
$finfo = finfo_open($const);
$mimeType = finfo_file($finfo, $filename);
finfo_close($finfo);
} elseif (function_exists('mime_content_type')) {
}
if (!$mimeType && function_exists('mime_content_type')) {
$mimeType = mime_content_type($filename);
} elseif (function_exists('exec')) {
}
if (!$mimeType && function_exists('exec')) {
$mimeType = trim(exec('file -b --mime-type ' . escapeshellarg($filename)));
if (!$mimeType) {
$mimeType = trim(exec('file --mime ' . escapeshellarg($filename)));
Expand Down Expand Up @@ -442,15 +445,17 @@ public static function isCorrectImageFileExt($filename, $authorizedExtensions =
*
* @param array $file Upload $_FILE value
* @param int $maxFileSize Maximum upload size
* @param array<string>|null $types Authorized extensions
* @param array<string>|null $mimeTypeList Authorized mimetypes
*
* @return bool|string Return false if no error encountered
*/
public static function validateUpload($file, $maxFileSize = 0, $types = null)
public static function validateUpload($file, $maxFileSize = 0, $types = null, $mimeTypeList = null)
{
if ((int) $maxFileSize > 0 && $file['size'] > (int) $maxFileSize) {
return Context::getContext()->getTranslator()->trans('Image is too large (%1$d kB). Maximum allowed: %2$d kB', array($file['size'] / 1024, $maxFileSize / 1024), 'Admin.Notifications.Error');
}
if (!ImageManager::isRealImage($file['tmp_name'], $file['type']) || !ImageManager::isCorrectImageFileExt($file['name'], $types) || preg_match('/\%00/', $file['name'])) {
if (!ImageManager::isRealImage($file['tmp_name'], $file['type'], $mimeTypeList) || !ImageManager::isCorrectImageFileExt($file['name'], $types) || preg_match('/\%00/', $file['name'])) {
return Context::getContext()->getTranslator()->trans('Image format not recognized, allowed formats are: .gif, .jpg, .png', array(), 'Admin.Notifications.Error');
}
if ($file['error']) {
Expand Down