mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 22:10:45 +02:00
Code Issues Releases Wiki Activity

Merge pull request #1819 from marc1706/ticket/11534

Browse Source 
[ticket/11534] Check remote avatar content type if possible
This commit is contained in:
Nathan Guse
2013-11-04 10:22:28 -08:00
parent ad69d5af8a 9b0b5481fe
commit cc54e6a9e5
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
phpBB/phpbb/avatar/driver/remote.php
View File

@@ -117,6 +117,37 @@ class remote extends \phpbb\avatar\driver\driver
$types = \fileupload::image_types();
$extension = strtolower(\filespec::get_extension($url));
// Check if this is actually an image
if ($file_stream = @fopen($url, 'r'))
{
// Timeout after 1 second
stream_set_timeout($file_stream, 1);
$meta = stream_get_meta_data($file_stream);
foreach ($meta['wrapper_data'] as $header)
{
$header = preg_split('/ /', $header, 2);
if (strtr(strtolower(trim($header[0], ':')), '_', '-') === 'content-type')
{
if (strpos($header[1], 'image/') !== 0)
{
$error[] = 'AVATAR_URL_INVALID';
fclose($file_stream);
return false;
}
else
{
fclose($file_stream);
break;
}
}
}
}
else
{
$error[] = 'AVATAR_URL_INVALID';
return false;
}
if (!empty($image_data) && (!isset($types[$image_data[2]]) || !in_array($extension, $types[$image_data[2]])))
{
if (!isset($types[$image_data[2]]))