From: Christopher Ng <chrng8@gmail.com>
Date: Tue, 31 May 2022 19:31:52 +0000 (+0000)
Subject: Validate custom dashboard background image
X-Git-Tag: v25.0.0beta1~279^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=00135986ab79e7fb15dc642b5308e62608d0ea59;p=nextcloud-server.git

Validate custom dashboard background image

Signed-off-by: Christopher Ng <chrng8@gmail.com>
---

diff --git a/apps/dashboard/lib/Service/BackgroundService.php b/apps/dashboard/lib/Service/BackgroundService.php
index 13ad03cf860..c98b92412cb 100644
--- a/apps/dashboard/lib/Service/BackgroundService.php
+++ b/apps/dashboard/lib/Service/BackgroundService.php
@@ -150,6 +150,10 @@ class BackgroundService {
 		$userFolder = $this->rootFolder->getUserFolder($this->userId);
 		/** @var File $file */
 		$file = $userFolder->get($path);
+		$image = new \OCP\Image();
+		if ($image->loadFromFileHandle($file->fopen('r')) === false) {
+			throw new InvalidArgumentException('Invalid image file');
+		}
 		$this->getAppDataFolder()->newFile('background.jpg', $file->fopen('r'));
 	}