makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1819 from marc1706/ticket/11534

Browse source 
[ticket/11534] Check remote avatar content type if possible
This commit is contained in:
Nathan Guse 2013-11-04 10:22:28 -08:00
commit cc54e6a9e5
2 changed files with 40 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
phpBB/phpbb/avatar/driver/remote.php
View file

@ -117,6 +117,37 @@ class remote extends \phpbb\avatar\driver\driver
$types = \fileupload::image_types();
$extension = strtolower(\filespec::get_extension($url));
// Check if this is actually an image
if ($file_stream = @fopen($url, 'r'))
{
// Timeout after 1 second
stream_set_timeout($file_stream, 1);
$meta = stream_get_meta_data($file_stream);
foreach ($meta['wrapper_data'] as $header)
{
$header = preg_split('/ /', $header, 2);
if (strtr(strtolower(trim($header[0], ':')), '_', '-') === 'content-type')
{
if (strpos($header[1], 'image/') !== 0)
{
$error[] = 'AVATAR_URL_INVALID';
fclose($file_stream);
return false;
}
else
{
fclose($file_stream);
break;
}
}
}
}
else
{
$error[] = 'AVATAR_URL_INVALID';
return false;
}
if (!empty($image_data) && (!isset($types[$image_data[2]]) || !in_array($extension, $types[$image_data[2]])))
{
if (!isset($types[$image_data[2]]))

9
tests/functional/avatar_acp_groups_test.php
View file

@ -50,6 +50,15 @@ class phpbb_functional_avatar_acp_groups_test extends phpbb_functional_common_av
'avatar_delete' => array('tick', ''),
),
),
array(
'The URL you specified is invalid.',
'avatar_driver_remote',
array(
'avatar_remote_url' => 'https://www.phpbb.com/avatar/55502f40dc8b7c769880b10874abc9d0.jpg',
'avatar_remote_width' => 80,
'avatar_remote_height' => 80,
),
),
);
}