danvics/pdfdraw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Only allow opening PDF files.

Browse source
This commit is contained in:
Joachim Bauch 2021-11-10 11:48:38 +01:00
parent 27abab0dee
commit f524238a24
No known key found for this signature in database
GPG key ID: 77C1D22D53E15F02
1 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
lib/Controller/ViewerController.php
View file

@ -52,6 +52,10 @@ use Symfony\Component\EventDispatcher\GenericEvent;
class ViewerController extends Controller {
const PDF_MIME_TYPES = [
'application/pdf',
];
/** @var string */
private $userId;
@ -262,6 +266,18 @@ class ViewerController extends Controller {
return $fileUrl;
}
private function isValidPdfFile($file) {
$mime = $file->getMimeType();
if ($mime) {
$mime = strtolower($mime);
}
if (!in_array($mime, self::PDF_MIME_TYPES)) {
return $this->l10n->t('File %s is not a PDF file (%s)', [$file->getName(), $mime]);
}
return null;
}
/**
* @NoAdminRequired
* @NoCSRFRequired
@ -282,6 +298,12 @@ class ViewerController extends Controller {
return ['error' => $error];
}
$error = $this->isValidPdfFile($file);
if (isset($error)) {
$this->logger->error("index: " . $fileId . " " . $error, array("app" => $this->appName));
return ['error' => $error];
}
$backend = $this->config->getAppValue('pdfdraw', 'backend');
if (!empty($backend)) {
$backend = json_decode($backend);
@ -329,6 +351,12 @@ class ViewerController extends Controller {
return ['error' => $error];
}
$error = $this->isValidPdfFile($file);
if (isset($error)) {
$this->logger->error("viewer: " . $fileId . " " . $error, array("app" => $this->appName));
return ['error' => $error];
}
if (!empty($token)) {
list ($share, $error) = $this->getShare($token);
if (isset($error)) {