-
-
Notifications
You must be signed in to change notification settings - Fork 181
update thumbnail, allow user to choose output format #3714
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: 6.2
Are you sure you want to change the base?
Changes from 6 commits
67fdcf7
00d5b9f
d105147
e2fc162
d712370
7bb2889
c4ed3a0
1b1eb1a
41e21a0
4d6ef76
5b7f93c
af0a675
a58165a
2810f68
f03121f
4a6e9ab
da6f8af
ec33d5e
fbf648a
bd53344
f4f2ad8
7f70ff9
1379159
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,6 +20,8 @@ | |
|
|
||
| class ImageController | ||
| { | ||
| private const SUPPORTED_FORMATS = ['jpg', 'webp', 'png', 'gif', 'avif']; | ||
|
|
||
| private Server $server; | ||
|
|
||
| /** | ||
|
|
@@ -45,17 +47,20 @@ public function thumbnail(Request $request, string $paramString, string $filenam | |
| return $this->sendErrorImage(); | ||
| } | ||
|
|
||
| $this->parseParameters($paramString); | ||
| $urlFilename = $filename; | ||
| $sourceFilename = $this->parseFormatFromFilename($filename); | ||
|
|
||
| try { | ||
| $filename = PathCanonicalize::canonicalize($this->getPath($request), $filename, true); | ||
| $sourceFilename = PathCanonicalize::canonicalize($this->getPath($request), $sourceFilename, true); | ||
| } catch (Exception) { | ||
| return $this->sendErrorImage(); | ||
| } | ||
|
|
||
| $this->parseParameters($paramString); | ||
| $this->createServer($request); | ||
| $this->saveThumb($request, $filename); | ||
| $this->saveThumb($request, $sourceFilename, $urlFilename); | ||
|
|
||
| return $this->buildResponse($request, $filename); | ||
| return $this->buildResponse($request, $sourceFilename); | ||
| } | ||
|
|
||
| private function createServer(Request $request): void | ||
|
|
@@ -82,7 +87,19 @@ private function getPath(Request $request, ?string $path = null, bool $absolute | |
| return $this->config->getPath($path, $absolute, $additional); | ||
| } | ||
|
|
||
| private function saveThumb(Request $request, string $filename): void | ||
| private function parseFormatFromFilename(string $filename): string | ||
| { | ||
| $ext = mb_strtolower(pathinfo($filename, PATHINFO_EXTENSION)); | ||
| if ($this->isSupportedFormat($ext) && pathinfo(pathinfo($filename, PATHINFO_FILENAME), PATHINFO_EXTENSION) !== '') { | ||
| $this->parameters['fm'] = $ext; | ||
|
|
||
| return mb_substr($filename, 0, -(mb_strlen($ext) + 1)); | ||
| } | ||
|
|
||
| return $filename; | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. If I understand correctly, the goal is to retrieve the last part of the path here. Why not just explode on
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm not able to allow maintainers to edit the PR ??? |
||
| } | ||
|
|
||
| private function saveThumb(Request $request, string $filename, string $urlFilename = ''): void | ||
| { | ||
| if (! $this->config->get('general/thumbnails/save_files', true)) { | ||
| return; | ||
|
|
@@ -95,7 +112,7 @@ private function saveThumb(Request $request, string $filename): void | |
| $thumbPath = Path::join( | ||
| $this->getPath($request, 'thumbs'), | ||
| $this->parameterPath(), | ||
| $filename | ||
| $urlFilename ?: $filename | ||
| ); | ||
|
|
||
| try { | ||
|
|
@@ -162,21 +179,38 @@ private function parseParameters(string $paramString): void | |
| $this->parameters = [ | ||
| 'w' => (isset($raw[0]) && is_numeric($raw[0])) ? (int) $raw[0] : 400, | ||
| 'h' => (isset($raw[1]) && is_numeric($raw[1])) ? (int) $raw[1] : 300, | ||
| 'fit' => $raw[2] ?? $this->config->get('general/thumbnails/default_cropping', 'default'), | ||
|
kouz75 marked this conversation as resolved.
|
||
| 'fm' => '', | ||
| 'fit' => '', | ||
| 'location' => 'files', | ||
| 'q' => (! empty($raw[2]) && 0 <= $raw[2] && $raw[2] <= 100) ? (int) $raw[2] : 80, | ||
| 'q' => 80, | ||
| ]; | ||
|
|
||
| if (isset($raw[4])) { | ||
| $this->parameters['fit'] = $this->parseFit($raw[3]); | ||
| $this->parameters['location'] = $raw[4]; | ||
| } elseif (isset($raw[3])) { | ||
| $possibleFit = $this->parseFit($raw[3]); | ||
| $remaining = array_values(array_filter( | ||
| array_slice($raw, 2), | ||
| static fn (int|string $value): bool => $value !== '' | ||
| )); | ||
|
|
||
| if (isset($remaining[0]) && is_numeric($remaining[0]) && 0 <= (int) $remaining[0] && (int) $remaining[0] <= 100) { | ||
| $this->parameters['q'] = (int) array_shift($remaining); | ||
| } | ||
|
|
||
| foreach ($remaining as $token) { | ||
| $token = (string) $token; | ||
| $normalizedToken = mb_strtolower($token); | ||
|
|
||
| if ($this->parameters['fm'] === '' && $this->isSupportedFormat($normalizedToken)) { | ||
| $this->parameters['fm'] = $normalizedToken; | ||
| continue; | ||
| } | ||
|
|
||
| $fit = $this->parseFit($normalizedToken); | ||
| if ($this->testFit($fit)) { | ||
| $this->parameters['fit'] = $fit; | ||
| continue; | ||
| } | ||
|
|
||
| if ($this->testFit($possibleFit)) { | ||
| $this->parameters['fit'] = $possibleFit; | ||
| } else { | ||
| $this->parameters['location'] = $raw[3]; | ||
| if ($this->parameters['location'] === 'files') { | ||
| $this->parameters['location'] = $token; | ||
| } | ||
| } | ||
| } | ||
|
|
@@ -203,6 +237,11 @@ private function testFit(string $fit): bool | |
| return (bool) preg_match('/^(contain|max|fill|stretch|crop)(-.+)?/', $fit); | ||
| } | ||
|
|
||
| private function isSupportedFormat(string $format): bool | ||
| { | ||
| return in_array($format, self::SUPPORTED_FORMATS, true); | ||
| } | ||
|
|
||
| public function parseFit(string $fit): string | ||
| { | ||
| return match ($fit) { | ||
|
|
@@ -217,14 +256,15 @@ public function parseFit(string $fit): string | |
|
|
||
| private function parameterPath(): string | ||
| { | ||
| return sprintf( | ||
| '%d_%d_%d_%s_%s', | ||
| $parts = array_filter([ | ||
| $this->parameters['w'] ?? 0, | ||
| $this->parameters['h'] ?? 0, | ||
| $this->parameters['q'] ?? 0, | ||
| $this->parameters['fit'] ?? '', | ||
| $this->parameters['location'] ?? '' | ||
| ); | ||
| $this->parameters['q'] ?? 80, | ||
| $this->parameters['fit'] ?? null, | ||
| $this->parameters['location'] ?? 'files', | ||
| ], fn (int|string|null $v): bool => $v !== null && $v !== '' && $v !== 0); | ||
|
|
||
| return implode('×', $parts); | ||
| } | ||
|
|
||
| public function sendErrorImage(): Response | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Direct usage of the filename will cause a regression into a security incident (#3661) we had in the past, namely a path traversal. Paths can only be used after a
canonicalizecall.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The filename is still used directly without sanitation, this needs to be resolved first.