IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 05:25:16 -05:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: force IM decoder based on file extension - part 3

Browse Source
This commit is contained in:
Régis Hanol
2018-07-25 23:55:06 +02:00
parent 800c57c6ab
commit f94aeaf6cf
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/models/optimized_image.rb
+7 -7
View File
@@ -123,7 +123,7 @@ class OptimizedImage < ActiveRecord::Base
def self.prepend_decoder!(path)
extension = File.extname(path)[1..-1]
raise Discourse::InvalidAccess unless extension[IM_DECODERS]
path = "#{extension}:#{path}"
"#{extension}:#{path}"
end
def self.thumbnail_or_resize
@@ -133,8 +133,8 @@ class OptimizedImage < ActiveRecord::Base
def self.resize_instructions(from, to, dimensions, opts = {})
ensure_safe_paths!(from, to)
prepend_decoder!(from)
prepend_decoder!(to)
from = prepend_decoder!(from)
to = prepend_decoder!(to)
# NOTE: ORDER is important!
%W{
@@ -170,8 +170,8 @@ class OptimizedImage < ActiveRecord::Base
def self.crop_instructions(from, to, dimensions, opts = {})
ensure_safe_paths!(from, to)
prepend_decoder!(from)
prepend_decoder!(to)
from = prepend_decoder!(from)
to = prepend_decoder!(to)
%W{
convert
@@ -205,8 +205,8 @@ class OptimizedImage < ActiveRecord::Base
def self.downsize_instructions(from, to, dimensions, opts = {})
ensure_safe_paths!(from, to)
prepend_decoder!(from)
prepend_decoder!(to)
from = prepend_decoder!(from)
to = prepend_decoder!(to)
%W{
convert