eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

[ATTACHMENTS] Restrict thumbnail generation to allowed sizes. Defaults to only configured sizes, but can be extended with the event 'GetAllowedThumbnailSizes'. The intention is to prevent DoS attacks, since handling a thumbnail request is a relatively slow process

Browse Source
This commit is contained in:
Hugo Sales
2021-04-28 21:53:02 +00:00
parent 4f6f1941da
commit aea8639d44
2 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/Controller/Attachment.php
View File

@@ -109,13 +109,16 @@ class Attachment extends Controller
assert(false, 'Attachment scope not implemented');
}
// TODO rate limit, limit to known sizes
$default_width = Common::config('thumbnail', 'width');
$default_height = Common::config('thumbnail', 'height');
$width = $this->int('w') ?: $default_width;
$height = $this->int('h') ?: $default_height;
$crop = $this->bool('c') ?: false;
$max_width = Common::config('thumbnail', 'width');
$max_height = Common::config('thumbnail', 'height');
$width = Common::clamp($this->int('w') ?: $max_width, min: 0, max: $max_width);
$height = Common::clamp($this->int('h') ?: $max_height, min: 0, max: $max_height);
$crop = $this->bool('c') ?: false;
Event::handle('GetAllowedThumbnailSizes', [&$sizes]);
if (!in_array(['width' => $width, 'height' => $height], $sizes)) {
throw new ClientException('The requested thumbnail dimensions are not allowed', 400); // 400 Bad Request
}
$thumbnail = AttachmentThumbnail::getOrCreate(attachment: $attachment, width: $width, height: $height, crop: $crop);