From 16c14060a81d4f7ed6be0bf5f95ca3c77733c18f Mon Sep 17 00:00:00 2001 From: default Date: Mon, 14 Aug 2023 15:12:09 +0200 Subject: [PATCH] Discard avatar uploads that are not images. --- html.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/html.c b/html.c index 79b833a..126f4ab 100644 --- a/html.c +++ b/html.c @@ -2415,20 +2415,24 @@ int html_post_handler(const xs_dict *req, const char *q_path, /* avatar upload */ xs_list *avatar_file = xs_dict_get(p_vars, "avatar_file"); - if (!xs_is_null(avatar_file) && xs_type(avatar_file) == XSTYPE_LIST) { - char *fn = xs_list_get(avatar_file, 0); + if (xs_type(avatar_file) == XSTYPE_LIST) { + const char *fn = xs_list_get(avatar_file, 0); - if (*fn != '\0') { - char *ext = strrchr(fn, '.'); - xs *id = xs_fmt("avatar%s", ext); - xs *url = xs_fmt("%s/s/%s", snac.actor, id); - int fo = xs_number_get(xs_list_get(avatar_file, 1)); - int fs = xs_number_get(xs_list_get(avatar_file, 2)); + if (fn && *fn) { + const char *mimetype = xs_mime_by_ext(fn); - /* store */ - static_put(&snac, id, payload + fo, fs); + if (xs_startswith(mimetype, "image/")) { + const char *ext = strrchr(fn, '.'); + xs *id = xs_fmt("avatar%s", ext); + xs *url = xs_fmt("%s/s/%s", snac.actor, id); + int fo = xs_number_get(xs_list_get(avatar_file, 1)); + int fs = xs_number_get(xs_list_get(avatar_file, 2)); - snac.config = xs_dict_set(snac.config, "avatar", url); + /* store */ + static_put(&snac, id, payload + fo, fs); + + snac.config = xs_dict_set(snac.config, "avatar", url); + } } }