knadh/listmonk
1
1
Fork 0
mirror of https://github.com/knadh/listmonk.git synced 2024-09-20 07:16:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add validation for filename with non-ASCII chars in media upload (#1973)

Browse source
This commit is contained in:
Bowrna 2024-08-05 20:08:33 +05:30 committed by GitHub
parent 01f7450bf0
commit 1e6e97e750
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 28 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmd/media.go
View file

@ -48,6 +48,10 @@ func handleUploadMedia(c echo.Context) error {
ext = strings.TrimPrefix(strings.ToLower(filepath.Ext(file.Filename)), ".") ext = strings.TrimPrefix(strings.ToLower(filepath.Ext(file.Filename)), ".")
contentType = file.Header.Get("Content-Type") contentType = file.Header.Get("Content-Type")
) )
if !isASCII(file.Filename) {
return echo.NewHTTPError(http.StatusUnprocessableEntity,
app.i18n.Ts("media.invalidFileName", "name", file.Filename))
}
// Validate file extension. // Validate file extension.
if !inArray("*", app.constants.MediaUpload.Extensions) { if !inArray("*", app.constants.MediaUpload.Extensions) {

10
cmd/utils.go
View file

@ -8,6 +8,7 @@ import (
"regexp" "regexp"
"strconv" "strconv"
"strings" "strings"
"unicode"
) )
var ( var (
@ -113,3 +114,12 @@ func titleCase(input string) string {
return strings.Join(parts, " ") return strings.Join(parts, " ")
} }
func isASCII(s string) bool {
for _, c := range s {
if c > unicode.MaxASCII {
return false
}
}
return true
}

25
docs/docs/content/apis/apis.md
View file

@ -44,15 +44,16 @@ All timestamp fields are in the format `2019-01-01T09:00:00.000000+05:30`. The s
### Common HTTP error codes ### Common HTTP error codes
| Code | | | Code | |
| ----- | ------------------------------------------------------------------------ | | ----- | ----------------------------------------------------------------------------|
| 400 | Missing or bad request parameters or values | | 400 | Missing or bad request parameters or values |
| 403 | Session expired or invalidate. Must relogin | | 403 | Session expired or invalidate. Must relogin |
| 404 | Request resource was not found | | 404 | Request resource was not found |
| 405 | Request method (GET, POST etc.) is not allowed on the requested endpoint | | 405 | Request method (GET, POST etc.) is not allowed on the requested endpoint |
| 410 | The requested resource is gone permanently | | 410 | The requested resource is gone permanently |
| 429 | Too many requests to the API (rate limiting) | | 422 | Unprocessable entity. Unable to process request as it contains invalid data |
| 500 | Something unexpected went wrong | | 429 | Too many requests to the API (rate limiting) |
| 502 | The backend OMS is down and the API is unable to communicate with it | | 500 | Something unexpected went wrong |
| 503 | Service unavailable; the API is down | | 502 | The backend OMS is down and the API is unable to communicate with it |
| 504 | Gateway timeout; the API is unreachable | | 503 | Service unavailable; the API is down |
| 504 | Gateway timeout; the API is unreachable |

1
i18n/en.json
View file

@ -288,6 +288,7 @@
"media.errorSavingThumbnail": "Error saving thumbnail: {error}", "media.errorSavingThumbnail": "Error saving thumbnail: {error}",
"media.errorUploading": "Error uploading file: {error}", "media.errorUploading": "Error uploading file: {error}",
"media.invalidFile": "Invalid file: {error}", "media.invalidFile": "Invalid file: {error}",
"media.invalidFileName": "Invalid filename {name}. Use only ASCII characters",
"media.title": "Media", "media.title": "Media",
"media.unsupportedFileType": "Unsupported file type ({type})", "media.unsupportedFileType": "Unsupported file type ({type})",
"media.upload": "Upload", "media.upload": "Upload",