IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-29 20:24:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1523 from dbarbera/avatar_formats_fix

Browse Source 
add image authorization on upload_avatar
This commit is contained in:
Régis Hanol 2013-10-14 05:33:25 -07:00
commit d80f4fa3f7
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/users_controller.rb
View File

@ -302,6 +302,10 @@ class UsersController < ApplicationController
file = params[:file] || params[:files].first
unless SiteSetting.authorized_image?(file)
return render status: 422, text: I18n.t("upload.images.unknown_image_type")
end
# check the file size (note: this might also be done in the web server)
filesize = File.size(file.tempfile)
max_size_kb = SiteSetting.max_image_size_kb * 1024

6
spec/controllers/users_controller_spec.rb
View File

@ -966,6 +966,12 @@ describe UsersController do
response.status.should eq 413
end
it 'rejects unauthorized images' do
SiteSetting.stubs(:authorized_image?).returns(false)
xhr :post, :upload_avatar, username: user.username, file: avatar
response.status.should eq 422
end
it 'is successful' do
upload = Fabricate(:upload)
Upload.expects(:create_for).returns(upload)