scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-11-08 07:21:03 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #318 from okriuchykhin/ok_SCI_736

Browse source 
Add whitelisting of supported image types [SCI-736]
This commit is contained in:
okriuchykhin 2016-11-28 09:32:49 +01:00 • committed by GitHub
commit 31f6379866
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/assets_controller.rb
View file

@ -114,7 +114,8 @@ class AssetsController < ApplicationController
fields: s3_post.fields
})
if (asset.file_content_type =~ /^image\//) == 0
if (asset.file_content_type =~
%r{/^image\/#{Constants::WHITELISTED_IMAGE_TYPES.join("|")}/}) == 0
asset.file.options[:styles].each do |style, option|
s3_post = S3_BUCKET.presigned_post(
key: asset.file.path(style)[1..-1],

3
app/models/asset.rb
View file

@ -138,7 +138,8 @@ class Asset < ActiveRecord::Base
end
def is_image?
!(self.file.content_type =~ /^image/).nil?
!(file.content_type =~
%r{/^image\/#{Constants::WHITELISTED_IMAGE_TYPES.join("|")}/}).nil?
end
def text?

2
config/initializers/constants.rb
View file

@ -201,6 +201,8 @@ class Constants
'text/plain'
].freeze
WHITELISTED_IMAGE_TYPES = ['gif', 'jpeg', 'png', 'svg+xml', 'bmp'].freeze
# Very basic regex to check for validity of emails
BASIC_EMAIL_REGEX = URI::MailTo::EMAIL_REGEXP