knadh/listmonk
1
1
Fork 0
mirror of https://github.com/knadh/listmonk.git synced 2024-09-19 23:06:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add validation for filename with non-ASCII chars in media upload (#1973)

Browse source
This commit is contained in:
Bowrna 2024-08-05 20:08:33 +05:30 committed by GitHub
parent 01f7450bf0
commit 1e6e97e750
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 28 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmd/media.go
View file

@ -48,6 +48,10 @@ func handleUploadMedia(c echo.Context) error {
ext = strings.TrimPrefix(strings.ToLower(filepath.Ext(file.Filename)), ".")
contentType = file.Header.Get("Content-Type")
)
if !isASCII(file.Filename) {
return echo.NewHTTPError(http.StatusUnprocessableEntity,
app.i18n.Ts("media.invalidFileName", "name", file.Filename))
}
// Validate file extension.
if !inArray("*", app.constants.MediaUpload.Extensions) {

10
cmd/utils.go
View file

@ -8,6 +8,7 @@ import (
"regexp"
"strconv"
"strings"
"unicode"
)
var (
@ -113,3 +114,12 @@ func titleCase(input string) string {
return strings.Join(parts, " ")
}
func isASCII(s string) bool {
for _, c := range s {
if c > unicode.MaxASCII {
return false
}
}
return true
}

25
docs/docs/content/apis/apis.md
View file

@ -44,15 +44,16 @@ All timestamp fields are in the format `2019-01-01T09:00:00.000000+05:30`. The s
### Common HTTP error codes
| Code | |
| ----- | ------------------------------------------------------------------------ |
| 400 | Missing or bad request parameters or values |
| 403 | Session expired or invalidate. Must relogin |
| 404 | Request resource was not found |
| 405 | Request method (GET, POST etc.) is not allowed on the requested endpoint |
| 410 | The requested resource is gone permanently |
| 429 | Too many requests to the API (rate limiting) |
| 500 | Something unexpected went wrong |
| 502 | The backend OMS is down and the API is unable to communicate with it |
| 503 | Service unavailable; the API is down |
| 504 | Gateway timeout; the API is unreachable |
| Code | |
| ----- | ----------------------------------------------------------------------------|
| 400 | Missing or bad request parameters or values |
| 403 | Session expired or invalidate. Must relogin |
| 404 | Request resource was not found |
| 405 | Request method (GET, POST etc.) is not allowed on the requested endpoint |
| 410 | The requested resource is gone permanently |
| 422 | Unprocessable entity. Unable to process request as it contains invalid data |
| 429 | Too many requests to the API (rate limiting) |
| 500 | Something unexpected went wrong |
| 502 | The backend OMS is down and the API is unable to communicate with it |
| 503 | Service unavailable; the API is down |
| 504 | Gateway timeout; the API is unreachable |

1
i18n/en.json
View file

@ -288,6 +288,7 @@
"media.errorSavingThumbnail": "Error saving thumbnail: {error}",
"media.errorUploading": "Error uploading file: {error}",
"media.invalidFile": "Invalid file: {error}",
"media.invalidFileName": "Invalid filename {name}. Use only ASCII characters",
"media.title": "Media",
"media.unsupportedFileType": "Unsupported file type ({type})",
"media.upload": "Upload",