diff options
| author | Kim "BKC" Carlbäcker <kim.carlbacker@gmail.com> | 2018-07-03 05:56:32 +0200 |
|---|---|---|
| committer | Lauris BH <lauris@nix.lv> | 2018-07-03 06:56:32 +0300 |
| commit | cbee921c28b9299a0f4ee751f8fd55a430b571f2 (patch) | |
| tree | a5ab67fa1703781eecc90701b2f701384ec7e3ba /models/user.go | |
| parent | 69796ddd64b89de066952ea19b6332f51bbf3f81 (diff) | |
| download | gitea-cbee921c28b9299a0f4ee751f8fd55a430b571f2.tar.gz gitea-cbee921c28b9299a0f4ee751f8fd55a430b571f2.zip | |
Limit uploaded avatar image-size to 4096x3072 by default (#4353)
Diffstat (limited to 'models/user.go')
| -rw-r--r-- | models/user.go | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/models/user.go b/models/user.go index 653e994263..5ac8658796 100644 --- a/models/user.go +++ b/models/user.go @@ -433,6 +433,17 @@ func (u *User) IsPasswordSet() bool { // UploadAvatar saves custom avatar for user. // FIXME: split uploads to different subdirs in case we have massive users. func (u *User) UploadAvatar(data []byte) error { + imgCfg, _, err := image.DecodeConfig(bytes.NewReader(data)) + if err != nil { + return fmt.Errorf("DecodeConfig: %v", err) + } + if imgCfg.Width > setting.AvatarMaxWidth { + return fmt.Errorf("Image width is to large: %d > %d", imgCfg.Width, setting.AvatarMaxWidth) + } + if imgCfg.Height > setting.AvatarMaxHeight { + return fmt.Errorf("Image height is to large: %d > %d", imgCfg.Height, setting.AvatarMaxHeight) + } + img, _, err := image.Decode(bytes.NewReader(data)) if err != nil { return fmt.Errorf("Decode: %v", err) |