Skip to content
Snippets Groups Projects
Commit 7f71ae60 authored by Georg Ehrke's avatar Georg Ehrke
Browse files

improve validation of oc\preview and implement preview of error icon if something went wrong

parent 5c31b843
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 159 additions and 96 deletions
lib/preview.php
+ 159
− 96
View file @ 7f71ae60
......@@ -426,6 +426,14 @@ class Preview {
return;
}
/**
* @brief show preview
* @return void
*/
public function show() {
return $this->showPreview();
}
/**
* @brief resize, crop and fix orientation
* @return image
......@@ -567,30 +575,40 @@ class Preview {
* @brief method that handles preview requests from users that are logged in
* @return void
*/
public static function previewRouter($params) {
public static function previewRouter() {
\OC_Util::checkLoggedIn();
$file = '';
$maxX = 0;
$maxY = 0;
$scalingup = true;
if(array_key_exists('file', $_GET)) $file = (string) urldecode($_GET['file']);
if(array_key_exists('x', $_GET)) $maxX = (int) $_GET['x'];
if(array_key_exists('y', $_GET)) $maxY = (int) $_GET['y'];
if(array_key_exists('scalingup', $_GET)) $scalingup = (bool) $_GET['scalingup'];
if($file !== '' && $maxX !== 0 && $maxY !== 0) {
try{
$preview = new Preview(\OC_User::getUser(), 'files', $file, $maxX, $maxY, $scalingup);
$preview->showPreview();
}catch(\Exception $e) {
\OC_Response::setStatus(404);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
exit;
}
}else{
\OC_Response::setStatus(404);
$file = array_key_exists('file', $_GET) ? (string) urldecode($_GET['file']) : '';
$maxX = array_key_exists('x', $_GET) ? (int) $_GET['x'] : '44';
$maxY = array_key_exists('y', $_GET) ? (int) $_GET['y'] : '44';
$scalingup = array_key_exists('scalingup', $_GET) ? (bool) $_GET['scalingup'] : true;
if($file === '') {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'No file parameter was passed', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
if($maxX === 0 || $maxY === 0) {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'x and/or y set to 0', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
try{
$preview = new Preview(\OC_User::getUser(), 'files');
$preview->setFile($file);
$preview->setMaxX($maxX);
$preview->setMaxY($maxY);
$preview->setScalingUp($scalingup);
$preview->show();
}catch(\Exception $e) {
\OC_Response::setStatus(500);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
self::showErrorPreview();
exit;
}
}
......@@ -599,94 +617,132 @@ class Preview {
* @brief method that handles preview requests from users that are not logged in / view shared folders that are public
* @return void
*/
public static function publicPreviewRouter($params) {
$file = '';
$maxX = 0;
$maxY = 0;
$scalingup = true;
$token = '';
$user = null;
$path = null;
if(array_key_exists('file', $_GET)) $file = (string) urldecode($_GET['file']);
if(array_key_exists('x', $_GET)) $maxX = (int) $_GET['x'];
if(array_key_exists('y', $_GET)) $maxY = (int) $_GET['y'];
if(array_key_exists('scalingup', $_GET)) $scalingup = (bool) $_GET['scalingup'];
if(array_key_exists('t', $_GET)) $token = (string) $_GET['t'];
$linkItem = \OCP\Share::getShareByToken($token);
if (is_array($linkItem) && isset($linkItem['uid_owner']) && isset($linkItem['file_source'])) {
$userid = $linkItem['uid_owner'];
\OC_Util::setupFS($userid);
$pathid = $linkItem['file_source'];
$path = \OC\Files\Filesystem::getPath($pathid);
$pathinfo = \OC\Files\Filesystem::getFileInfo($path);
$sharedfile = null;
if($linkItem['item_type'] === 'folder') {
//clean up file parameter
$sharedfile = \OC\Files\Filesystem::normalizePath($file);
if(!\OC\Files\Filesystem::isValidPath($file)) {
\OC_Response::setStatus(403);
exit;
}
} else if($linkItem['item_type'] === 'file') {
$parent = $pathinfo['parent'];
$path = \OC\Files\Filesystem::getPath($parent);
$sharedfile = $pathinfo['name'];
}
public static function publicPreviewRouter() {
if(!\OC_App::isEnabled('files_sharing')){
exit;
}
$path = \OC\Files\Filesystem::normalizePath($path, false);
if(substr($path, 0, 1) == '/') {
$path = substr($path, 1);
}
$file = array_key_exists('file', $_GET) ? (string) urldecode($_GET['file']) : '';
$maxX = array_key_exists('x', $_GET) ? (int) $_GET['x'] : '44';
$maxY = array_key_exists('y', $_GET) ? (int) $_GET['y'] : '44';
$scalingup = array_key_exists('scalingup', $_GET) ? (bool) $_GET['scalingup'] : true;
$token = array_key_exists('t', $_GET) ? (string) $_GET['t'] : '';
if($token === ''){
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'No token parameter was passed', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
if($userid !== null && $path !== null && $sharedfile !== null) {
try{
$preview = new Preview($userid, 'files/' . $path, $sharedfile, $maxX, $maxY, $scalingup);
$preview->showPreview();
}catch(\Exception $e) {
\OC_Response::setStatus(404);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
$linkedItem = \OCP\Share::getShareByToken($token);
if($linkedItem === false || ($linkedItem['item_type'] !== 'file' && $linkedItem['item_type'] !== 'folder')) {
\OC_Response::setStatus(404);
\OC_Log::write('core-preview', 'Passed token parameter is not valid', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
if(!isset($linkedItem['uid_owner']) || !isset($linkedItem['file_source'])) {
\OC_Response::setStatus(500);
\OC_Log::write('core-preview', 'Passed token seems to be valid, but it does not contain all necessary information . ("' . $token . '")');
self::showErrorPreview();
exit;
}
$userid = $linkedItem['uid_owner'];
\OC_Util::setupFS($userid);
$pathid = $linkedItem['file_source'];
$path = \OC\Files\Filesystem::getPath($pathid);
$pathinfo = \OC\Files\Filesystem::getFileInfo($path);
$sharedfile = null;
if($linkedItem['item_type'] === 'folder') {
$isvalid = \OC\File\Filesystem::isValidPath($file);
if(!$isvalid) {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'Passed filename is not valid, might be malicious (file:"' . $file . '";ip:"' . $_SERVER['REMOTE_ADDR'] . '")', \OC_Log::WARN);
self::showErrorPreview();
exit;
}
}else{
\OC_Response::setStatus(404);
$sharedfile = \OC\Files\Filesystem::normalizePath($file);
}
if($linkedItem['item_type'] === 'file') {
$parent = $pathinfo['parent'];
$path = \OC\Files\Filesystem::getPath($parent);
$sharedfile = $pathinfo['name'];
}
$path = \OC\Files\Filesystem::normalizePath($path, false);
if(substr($path, 0, 1) == '/') {
$path = substr($path, 1);
}
if($maxX === 0 || $maxY === 0) {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'x and/or y set to 0', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
$root = 'files/' . $path;
try{
$preview = new Preview($userid, $path);
$preview->setFile($file);
$preview->setMaxX($maxX);
$preview->setMaxY($maxY);
$preview->setScalingUp($scalingup);
$preview->show();
}catch(\Exception $e) {
\OC_Response::setStatus(500);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
self::showErrorPreview();
exit;
}
}
public static function trashbinPreviewRouter() {
\OC_Util::checkLoggedIn();
if(!\OC_App::isEnabled('files_trashbin')){
exit;
}
\OC_Util::checkLoggedIn();
$file = '';
$maxX = 0;
$maxY = 0;
$scalingup = true;
if(array_key_exists('file', $_GET)) $file = (string) urldecode($_GET['file']);
if(array_key_exists('x', $_GET)) $maxX = (int) $_GET['x'];
if(array_key_exists('y', $_GET)) $maxY = (int) $_GET['y'];
if(array_key_exists('scalingup', $_GET)) $scalingup = (bool) $_GET['scalingup'];
if($file !== '' && $maxX !== 0 && $maxY !== 0) {
try{
$preview = new Preview(\OC_User::getUser(), 'files_trashbin/files', $file, $maxX, $maxY, $scalingup);
$preview->showPreview();
}catch(\Exception $e) {
\OC_Response::setStatus(404);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
exit;
}
}else{
\OC_Response::setStatus(404);
$file = array_key_exists('file', $_GET) ? (string) urldecode($_GET['file']) : '';
$maxX = array_key_exists('x', $_GET) ? (int) $_GET['x'] : '44';
$maxY = array_key_exists('y', $_GET) ? (int) $_GET['y'] : '44';
$scalingup = array_key_exists('scalingup', $_GET) ? (bool) $_GET['scalingup'] : true;
if($file === '') {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'No file parameter was passed', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
if($maxX === 0 || $maxY === 0) {
\OC_Response::setStatus(400); //400 Bad Request
\OC_Log::write('core-preview', 'x and/or y set to 0', \OC_Log::DEBUG);
self::showErrorPreview();
exit;
}
try{
$preview = new Preview(\OC_User::getUser(), 'files_trashbin/files');
$preview->setFile($file);
$preview->setMaxX($maxX);
$preview->setMaxY($maxY);
$preview->setScalingUp($scalingup);
$preview->showPreview();
}catch(\Exception $e) {
\OC_Response::setStatus(500);
\OC_Log::write('core', $e->getmessage(), \OC_Log::ERROR);
self::showErrorPreview();
exit;
}
}
......@@ -703,4 +759,11 @@ class Preview {
$preview = new Preview(\OC_User::getUser(), 'files/', $path, 0, 0, false, true);
$preview->deleteAllPreviews();
}
private static function showErrorPreview() {
$path = \OC::$SERVERROOT . '/core/img/actions/delete.png';
$preview = new \OC_Image($path);
$preview->preciseResize(44, 44);
$preview->show();
}
}
\ No newline at end of file
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment