post.php: implement safe PDF thumbnailing

This commit is contained in:
Zankaria 2025-04-21 15:11:32 +02:00
parent 28f75c8aed
commit 8282d5cd63

View file

@ -1447,10 +1447,36 @@ function handle_post(Context $ctx)
}
$image->destroy();
} else {
if (
($file['extension'] == "pdf" && $config['pdf_file_thumbnail']) ||
($file['extension'] == "djvu" && $config['djvu_file_thumbnail'])
) {
$mime = \mime_content_type($file['tmp_name']);
if ($file['extension'] === "pdf" && $config['pdf_file_thumbnail']) {
if ($mime !== 'application/pdf' && $mime !== 'application/x-pdf') {
error($config['error']['invalidfile']);
}
$e_thumb_path = \escapeshellarg($file['thumb']);
$e_file_path = \escapeshellarg($file['tmp_name']);
$thumb_width = $config['thumb_width'];
$thumb_height = $config['thumb_height'];
// Generates a PPM image and pipes it directly into convert for resizing + type conversion.
$error = shell_exec_error("gs -dSAFER -dBATCH -dNOPAUSE -dQUIET
-sDEVICE=ppmraw -r100 -dFirstPage=1 -dLastPage=1 -sOutputFile=- $e_file_path
| convert -thumbnail {$thumb_width}x{$thumb_height} ppm:- $e_thumb_path");
if ($error) {
$log = $ctx->get(LogDriver::class);
$log->log(LogDriver::ERROR, 'Could not render thumbnail for PDF file, using static fallback.');
$path = sprintf($config['file_thumb'], isset($config['file_icons'][$file['extension']]) ? $config['file_icons'][$file['extension']] : $config['file_icons']['default']);
}
$file['thumb'] = basename($file['thumb']);
$size = @getimagesize($path);
$file['thumbwidth'] = $size[0];
$file['thumbheight'] = $size[1];
$file['width'] = $size[0];
$file['height'] = $size[1];
}
if ($file['extension'] == "djvu" && $config['djvu_file_thumbnail']) {
$path = $file['thumb'];
$error = shell_exec_error('convert -size ' . $config['thumb_width'] . 'x' . $config['thumb_height'] . ' -thumbnail ' . $config['thumb_width'] . 'x' . $config['thumb_height'] . ' -background white -alpha remove ' .
escapeshellarg($file['tmp_name'] . '[0]') . ' ' .