local-it/vikunja-api
Archived
0
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

feat: restrict max avatar size

Browse source 
resolves #1171
This commit is contained in:
kolaente 2022-06-12 18:29:12 +02:00
parent 172a6214d7
commit 2f25b48869
Signed by untrusted user who does not match committer: konrad
GPG key ID: F40E70337AB24C9B
7 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
pkg/routes/api/v1/avatar.go
View file

@ -17,6 +17,7 @@
package v1
import (
"code.vikunja.io/api/pkg/config"
"code.vikunja.io/api/pkg/db"
"code.vikunja.io/api/pkg/files"
"code.vikunja.io/api/pkg/log"
@ -49,7 +50,7 @@ import (
// @tags user
// @Produce octet-stream
// @Param username path string true "The username of the user who's avatar you want to get"
// @Param size query int false "The size of the avatar you want to get"
// @Param size query int false "The size of the avatar you want to get. If bigger than the max configured size this will be adjusted to the maximum size."
// @Success 200 {} blob "The avatar"
// @Failure 404 {object} models.Message "The user does not exist."
// @Failure 500 {object} models.Message "Internal error"
@ -97,6 +98,9 @@ func GetAvatar(c echo.Context) error {
return handler.HandleHTTPError(err, c)
}
}
if sizeInt > config.ServiceMaxAvatarSize.GetInt64() {
sizeInt = config.ServiceMaxAvatarSize.GetInt64()
}
// Get the avatar
a, mimeType, err := avatarProvider.GetAvatar(u, sizeInt)