##// END OF EJS Templates
Decompression bomb protection in image viewing
neko259 -
r1820:668d6c7d default
parent child Browse files
Show More
@@ -1,5 +1,7 b''
1 import re
1 import re
2
2
3 from PIL import Image
4
3 from django.contrib.staticfiles import finders
5 from django.contrib.staticfiles import finders
4 from django.contrib.staticfiles.templatetags.staticfiles import static
6 from django.contrib.staticfiles.templatetags.staticfiles import static
5 from django.core.files.images import get_image_dimensions
7 from django.core.files.images import get_image_dimensions
@@ -145,7 +147,15 b' class ImageViewer(AbstractViewer):'
145 def get_format_view(self):
147 def get_format_view(self):
146 metadata = '{}, {}'.format(self.file.name.split('.')[-1],
148 metadata = '{}, {}'.format(self.file.name.split('.')[-1],
147 filesizeformat(self.file.size))
149 filesizeformat(self.file.size))
150
151 Image.warnings.simplefilter('error', Image.DecompressionBombWarning)
152 try:
148 width, height = get_image_dimensions(self.file.path)
153 width, height = get_image_dimensions(self.file.path)
154 except Exception:
155 # If the image is a decompression bomb, treat it as just a regular
156 # file
157 return super().get_format_view()
158
149 preview_path = self.file.path.replace('.', '.200x150.')
159 preview_path = self.file.path.replace('.', '.200x150.')
150 pre_width, pre_height = get_image_dimensions(preview_path)
160 pre_width, pre_height = get_image_dimensions(preview_path)
151
161
General Comments 0
You need to be logged in to leave comments. Login now