From c62762297cf2a06bad998a2b950b96102cb6e682 Mon Sep 17 00:00:00 2001 From: Hypolite Petovan Date: Wed, 15 Mar 2023 19:25:17 -0400 Subject: [PATCH 1/2] Prevent template generation in media/photo/upload output --- src/Module/Media/Photo/Upload.php | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/src/Module/Media/Photo/Upload.php b/src/Module/Media/Photo/Upload.php index 2b04d3582..8b56540f4 100644 --- a/src/Module/Media/Photo/Upload.php +++ b/src/Module/Media/Photo/Upload.php @@ -25,10 +25,9 @@ use Friendica\App; use Friendica\Core\Config\Capability\IManageConfigValues; use Friendica\Core\L10n; use Friendica\Core\Session\Capability\IHandleUserSessions; -use Friendica\Database\Database; +use Friendica\Core\System; use Friendica\Model\Photo; use Friendica\Model\User; -use Friendica\Module\BaseApi; use Friendica\Module\Response; use Friendica\Navigation\SystemMessages; use Friendica\Network\HTTPException\InternalServerErrorException; @@ -45,9 +44,6 @@ use Psr\Log\LoggerInterface; */ class Upload extends \Friendica\BaseModule { - /** @var Database */ - private $database; - /** @var IHandleUserSessions */ private $userSession; @@ -60,14 +56,17 @@ class Upload extends \Friendica\BaseModule /** @var bool */ private $isJson = false; - public function __construct(IManageConfigValues $config, SystemMessages $systemMessages, IHandleUserSessions $userSession, Database $database, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = []) + /** @var App\Page */ + private $page; + + public function __construct(App\Page $page, IManageConfigValues $config, SystemMessages $systemMessages, IHandleUserSessions $userSession, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = []) { parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters); - $this->database = $database; $this->userSession = $userSession; $this->systemMessages = $systemMessages; $this->config = $config; + $this->page = $page; } protected function post(array $request = []) @@ -80,12 +79,12 @@ class Upload extends \Friendica\BaseModule if (!$owner) { $this->logger->warning('Owner not found.', ['uid' => $this->userSession->getLocalUserId()]); - return $this->return(401, $this->t('Invalid request.')); + $this->return(401, $this->t('Invalid request.')); } if (empty($_FILES['userfile']) && empty($_FILES['media'])) { $this->logger->warning('Empty "userfile" and "media" field'); - return $this->return(401, $this->t('Invalid request.')); + $this->return(401, $this->t('Invalid request.')); } $src = ''; @@ -134,7 +133,7 @@ class Upload extends \Friendica\BaseModule if ($src == '') { $this->logger->warning('File source (temporary file) cannot be determined', ['$_FILES' => $_FILES]); - return $this->return(401, $this->t('Invalid request.'), true); + $this->return(401, $this->t('Invalid request.'), true); } $filetype = Images::getMimeTypeBySource($src, $filename, $filetype); @@ -152,7 +151,7 @@ class Upload extends \Friendica\BaseModule if (!$image->isValid()) { @unlink($src); $this->logger->warning($this->t('Unable to process image.'), ['imagedata[]' => gettype($imagedata), 'filetype' => $filetype]); - return $this->return(401, $this->t('Unable to process image.')); + $this->return(401, $this->t('Unable to process image.')); } $image->orient($src); @@ -185,7 +184,7 @@ class Upload extends \Friendica\BaseModule if ($filesize > $maximagesize) { @unlink($src); $this->logger->notice('Image size is too big', ['size' => $filesize, 'max' => $maximagesize]); - return $this->return(401, $this->t('Image exceeds size limit of %s', Strings::formatBytes($maximagesize))); + $this->return(401, $this->t('Image exceeds size limit of %s', Strings::formatBytes($maximagesize))); } } @@ -203,7 +202,7 @@ class Upload extends \Friendica\BaseModule $result = Photo::store($image, $owner['uid'], 0, $resource_id, $filename, $album, 0, Photo::DEFAULT, $allow_cid); if (!$result) { $this->logger->warning('Photo::store() failed', ['result' => $result]); - return $this->return(401, $this->t('Image upload failed.')); + $this->return(401, $this->t('Image upload failed.')); } if ($width > 640 || $height > 640) { @@ -223,7 +222,7 @@ class Upload extends \Friendica\BaseModule } $this->logger->info('upload done'); - return $this->return(200, "\n\n" . '[url=' . $this->baseUrl . '/photos/' . $owner['nickname'] . '/image/' . $resource_id . '][img]' . $this->baseUrl . "/photo/$resource_id-$smallest." . $image->getExt() . "[/img][/url]\n\n"); + $this->return(200, "\n\n" . '[url=' . $this->baseUrl . '/photos/' . $owner['nickname'] . '/image/' . $resource_id . '][img]' . $this->baseUrl . "/photo/$resource_id-$smallest." . $image->getExt() . "[/img][/url]\n\n"); } /** @@ -250,5 +249,8 @@ class Upload extends \Friendica\BaseModule $this->response->addContent($message); } + + $this->page->exit($this->response->generate()); + System::exit(); } } From 54afccc852f508b0c9d1dd1a22ef8c8c9c14bc9c Mon Sep 17 00:00:00 2001 From: Hypolite Petovan Date: Wed, 15 Mar 2023 19:30:03 -0400 Subject: [PATCH 2/2] Prevent template generation in media/attachment/upload output --- src/Module/Media/Attachment/Upload.php | 43 ++++++++++++++------------ 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/src/Module/Media/Attachment/Upload.php b/src/Module/Media/Attachment/Upload.php index 046d85bc9..b837b8df7 100644 --- a/src/Module/Media/Attachment/Upload.php +++ b/src/Module/Media/Attachment/Upload.php @@ -25,7 +25,7 @@ use Friendica\App; use Friendica\Core\Config\Capability\IManageConfigValues; use Friendica\Core\L10n; use Friendica\Core\Session\Capability\IHandleUserSessions; -use Friendica\Database\Database; +use Friendica\Core\System; use Friendica\Model\Attach; use Friendica\Model\User; use Friendica\Module\Response; @@ -42,9 +42,6 @@ use Psr\Log\LoggerInterface; */ class Upload extends \Friendica\BaseModule { - /** @var Database */ - private $database; - /** @var IHandleUserSessions */ private $userSession; @@ -57,31 +54,32 @@ class Upload extends \Friendica\BaseModule /** @var bool */ private $isJson; - public function __construct(SystemMessages $systemMessages, IManageConfigValues $config, IHandleUserSessions $userSession, Database $database, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = []) + /** @var App\Page */ + private $page; + + public function __construct(App\Page $page, SystemMessages $systemMessages, IManageConfigValues $config, IHandleUserSessions $userSession, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = []) { parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters); - $this->database = $database; $this->userSession = $userSession; $this->config = $config; $this->systemMessages = $systemMessages; + $this->page = $page; } protected function post(array $request = []) { - if ($this->isJson = !empty($request['response']) && $request['response'] == 'json') { - $this->response->setType(Response::TYPE_JSON, 'application/json'); - } + $this->isJson = !empty($request['response']) && $request['response'] == 'json'; $owner = User::getOwnerDataById($this->userSession->getLocalUserId()); if (!$owner) { $this->logger->warning('Owner not found.', ['uid' => $this->userSession->getLocalUserId()]); - return $this->return(401, $this->t('Invalid request.')); + $this->return(401, $this->t('Invalid request.')); } if (empty($_FILES['userfile'])) { $this->logger->warning('No file uploaded (empty userfile)'); - return $this->return(401, $this->t('Invalid request.'), true); + $this->return(401, $this->t('Invalid request.'), true); } $tempFileName = $_FILES['userfile']['tmp_name']; @@ -98,14 +96,14 @@ class Upload extends \Friendica\BaseModule @unlink($tempFileName); $msg = $this->t('Sorry, maybe your upload is bigger than the PHP configuration allows') . '
' . $this->t('Or - did you try to upload an empty file?'); $this->logger->warning($msg, ['fileSize' => $fileSize]); - return $this->return(401, $msg, true); + $this->return(401, $msg, true); } if ($maxFileSize && $fileSize > $maxFileSize) { @unlink($tempFileName); $msg = $this->t('File exceeds size limit of %s', Strings::formatBytes($maxFileSize)); $this->logger->warning($msg, ['fileSize' => $fileSize]); - return $this->return(401, $msg); + $this->return(401, $msg); } $newid = Attach::storeFile($tempFileName, $owner['uid'], $fileName, '<' . $owner['id'] . '>'); @@ -115,16 +113,16 @@ class Upload extends \Friendica\BaseModule if ($newid === false) { $msg = $this->t('File upload failed.'); $this->logger->warning($msg); - return $this->return(500, $msg); + $this->return(500, $msg); } if ($this->isJson) { - $content = json_encode(['ok' => true, 'id' => $newid], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT); + $content = $newid; } else { $content = "\n\n" . '[attachment]' . $newid . '[/attachment]' . "\n"; } - return $this->response->addContent($content); + $this->return(200, $content); } /** @@ -136,16 +134,23 @@ class Upload extends \Friendica\BaseModule */ private function return(int $httpCode, string $message, bool $systemMessage = false): void { - $this->response->setStatus($httpCode, $message); - if ($this->isJson) { - $this->response->addContent(json_encode(['error' => $message], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT)); + $message = $httpCode >= 400 ? ['error' => $message] : ['ok' => true, 'id' => $message]; + $this->response->setType(Response::TYPE_JSON, 'application/json'); + $this->response->addContent(json_encode($message, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT)); } else { if ($systemMessage) { $this->systemMessages->addNotice($message); } + if ($httpCode >= 400) { + $this->response->setStatus($httpCode, $message); + } + $this->response->addContent($message); } + + $this->page->exit($this->response->generate()); + System::exit(); } }