groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-05 17:01:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanatize SVG files, even when they try to hide themselves with a different extension

Browse source
This commit is contained in:
Jan Böhmer 2026-06-17 22:38:41 +02:00
parent 98df91d785
commit 02726fdf69
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/Services/Attachments/AttachmentSubmitHandler.php
View file

@ -543,8 +543,10 @@ class AttachmentSubmitHandler
return $attachment; return $attachment;
} }
$guessed_mime_type = $this->mimeTypes->guessMimeType($path);
//Check if the file is an SVG //Check if the file is an SVG
if ($attachment->getExtension() === "svg") { if ($guessed_mime_type === "image/svg+xml" || $attachment->getExtension() === "svg") {
$this->SVGSanitizer->sanitizeFile($path); $this->SVGSanitizer->sanitizeFile($path);
} }