From 296c1533e7d223f9cb819431c410a5fd6ae89c44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kim=20=22BKC=22=20Carlb=C3=A4cker?= Date: Mon, 2 Jul 2018 23:19:24 +0200 Subject: [PATCH 1/2] Limit uploaded avatar image-size to 4096x3072 by default --- custom/conf/app.ini.sample | 4 ++++ models/user.go | 11 +++++++++++ modules/setting/setting.go | 4 ++++ routers/repo/authorized_keys | 4 ++++ 4 files changed, 23 insertions(+) create mode 100644 routers/repo/authorized_keys diff --git a/custom/conf/app.ini.sample b/custom/conf/app.ini.sample index f823f68e4f268..774a1df59887b 100644 --- a/custom/conf/app.ini.sample +++ b/custom/conf/app.ini.sample @@ -402,6 +402,10 @@ SESSION_LIFE_TIME = 86400 [picture] AVATAR_UPLOAD_PATH = data/avatars +; Max Width and Height of uploaded avatars. This is to limit the amount of RAM +; used when resizing the image. +AVATAR_MAX_WIDTH = 4096 +AVATAR_MAX_HEIGHT = 3072 ; Chinese users can choose "duoshuo" ; or a custom avatar source, like: http://cn.gravatar.com/avatar/ GRAVATAR_SOURCE = gravatar diff --git a/models/user.go b/models/user.go index 653e994263222..5ac86587966a8 100644 --- a/models/user.go +++ b/models/user.go @@ -433,6 +433,17 @@ func (u *User) IsPasswordSet() bool { // UploadAvatar saves custom avatar for user. // FIXME: split uploads to different subdirs in case we have massive users. func (u *User) UploadAvatar(data []byte) error { + imgCfg, _, err := image.DecodeConfig(bytes.NewReader(data)) + if err != nil { + return fmt.Errorf("DecodeConfig: %v", err) + } + if imgCfg.Width > setting.AvatarMaxWidth { + return fmt.Errorf("Image width is to large: %d > %d", imgCfg.Width, setting.AvatarMaxWidth) + } + if imgCfg.Height > setting.AvatarMaxHeight { + return fmt.Errorf("Image height is to large: %d > %d", imgCfg.Height, setting.AvatarMaxHeight) + } + img, _, err := image.Decode(bytes.NewReader(data)) if err != nil { return fmt.Errorf("Decode: %v", err) diff --git a/modules/setting/setting.go b/modules/setting/setting.go index cf9f59853bb6c..a5f4457f33374 100644 --- a/modules/setting/setting.go +++ b/modules/setting/setting.go @@ -341,6 +341,8 @@ var ( // Picture settings AvatarUploadPath string + AvatarMaxWidth int + AvatarMaxHeight int GravatarSource string GravatarSourceURL *url.URL DisableGravatar bool @@ -1024,6 +1026,8 @@ func NewContext() { if !filepath.IsAbs(AvatarUploadPath) { AvatarUploadPath = path.Join(AppWorkPath, AvatarUploadPath) } + AvatarMaxWidth = sec.Key("AVATAR_MAX_WIDTH").MustInt(4096) + AvatarMaxHeight = sec.Key("AVATAR_MAX_HEIGHT").MustInt(3072) switch source := sec.Key("GRAVATAR_SOURCE").MustString("gravatar"); source { case "duoshuo": GravatarSource = "http://gravatar.duoshuo.com/avatar/" diff --git a/routers/repo/authorized_keys b/routers/repo/authorized_keys new file mode 100644 index 0000000000000..60f29d50057bc --- /dev/null +++ b/routers/repo/authorized_keys @@ -0,0 +1,4 @@ +# gitea public key +command="/tmp/go-build105149861/b434/repo.test serv key-1 --config=''",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAu7tvIvX6ZHrRXuZNfkR3XLHSsuCK9Zn3X58lxBcQzuo5xZgB6vRwwm/QtJuF+zZPtY5hsQILBLmF+BZ5WpKZp1jBeSjH2G7lxet9kbcH+kIVj0tPFEoyKI9wvWqIwC4prx/WVk2wLTJjzBAhyNxfEq7C9CeiX9pQEbEqJfkKCQ== nocomment +# gitea public key +command="/tmp/go-build105149861/b434/repo.test serv key-2 --config=''",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAu7tvIvX6ZHrRXuZNfkR3XLHSsuCK9Zn3X58lxBcQzuo5xZgB6vRwwm/QtJuF+zZPtY5hsQILBLmF+BZ5WpKZp1jBeSjH2G7lxet9kbcH+kIVj0tPFEoyKI9wvWqIwC4prx/WVk2wLTJjzBAhyNxfEq7C9CeiX9pQEbEqJfkKCQ== nocomment From cb69ac88c82d92d6c633a0009ab085db854a32d9 Mon Sep 17 00:00:00 2001 From: Lauris BH Date: Tue, 3 Jul 2018 01:17:23 +0300 Subject: [PATCH 2/2] Delete unneeded file --- routers/repo/authorized_keys | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 routers/repo/authorized_keys diff --git a/routers/repo/authorized_keys b/routers/repo/authorized_keys deleted file mode 100644 index 60f29d50057bc..0000000000000 --- a/routers/repo/authorized_keys +++ /dev/null @@ -1,4 +0,0 @@ -# gitea public key -command="/tmp/go-build105149861/b434/repo.test serv key-1 --config=''",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAu7tvIvX6ZHrRXuZNfkR3XLHSsuCK9Zn3X58lxBcQzuo5xZgB6vRwwm/QtJuF+zZPtY5hsQILBLmF+BZ5WpKZp1jBeSjH2G7lxet9kbcH+kIVj0tPFEoyKI9wvWqIwC4prx/WVk2wLTJjzBAhyNxfEq7C9CeiX9pQEbEqJfkKCQ== nocomment -# gitea public key -command="/tmp/go-build105149861/b434/repo.test serv key-2 --config=''",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAu7tvIvX6ZHrRXuZNfkR3XLHSsuCK9Zn3X58lxBcQzuo5xZgB6vRwwm/QtJuF+zZPtY5hsQILBLmF+BZ5WpKZp1jBeSjH2G7lxet9kbcH+kIVj0tPFEoyKI9wvWqIwC4prx/WVk2wLTJjzBAhyNxfEq7C9CeiX9pQEbEqJfkKCQ== nocomment