From 656e3f7a24d5ce64f10a1c8032f9b76fee1c9908 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 29 Aug 2016 16:50:01 +0200 Subject: Check the mimetype before reading the content and catch exception Signed-off-by: Joas Schilling --- core/Controller/AvatarController.php | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'core/Controller/AvatarController.php') diff --git a/core/Controller/AvatarController.php b/core/Controller/AvatarController.php index b27d1182225..c6f320dd0fe 100644 --- a/core/Controller/AvatarController.php +++ b/core/Controller/AvatarController.php @@ -189,7 +189,22 @@ class AvatarController extends Controller { Http::STATUS_BAD_REQUEST ); } - $content = $node->getContent(); + + if ($node->getMimeType() !== 'image/jpeg' && $node->getMimeType() !== 'image/png') { + return new JSONResponse( + ['data' => ['message' => $this->l->t('The selected file is not an image.')]], + Http::STATUS_BAD_REQUEST + ); + } + + try { + $content = $node->getContent(); + } catch (\OCP\Files\NotPermittedException $e) { + return new JSONResponse( + ['data' => ['message' => $this->l->t('The selected file cannot be read.')]], + Http::STATUS_BAD_REQUEST + ); + } } elseif (!is_null($files)) { if ( $files['error'][0] === 0 && -- cgit v1.2.3