jro_apps/redmine Commit - r14980:bf81c96b79cc

Make sure we only invoke Imagemagick if this is actually an image (#22721)....

Jean-Philippe Lang -

r14980:bf81c96b79cc

parent child

Context file:

r14980:bf81c96b79cc

Collapse all files

Gemfile +1 0

             source 'https://rubygems.org'
             if Gem::Version.new(Bundler::VERSION) < Gem::Version.new('1.5.0')
               abort "Redmine requires Bundler 1.5.0 or higher (you're using #{Bundler::VERSION}).\nPlease update with 'gem update bundler'."
             end
             gem "rails", "4.2.6"
             gem "jquery-rails", "~> 3.1.4"
             gem "coderay", "~> 1.1.0"
             gem "builder", ">= 3.0.4"
             gem "request_store", "1.0.5"
             gem "mime-types", (RUBY_VERSION >= "2.0" ? "~> 3.0" : "~> 2.99")
             gem "protected_attributes"
             gem "actionpack-action_caching"
             gem "actionpack-xml_parser"
             gem "roadie-rails"
+            gem "mimemagic"
             # Request at least nokogiri 1.6.7.2 because of security advisories
             gem "nokogiri", ">= 1.6.7.2"
             # Request at least rails-html-sanitizer 1.0.3 because of security advisories
             gem "rails-html-sanitizer", ">= 1.0.3"
             # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
             gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin, :jruby]
             gem "rbpdf", "~> 1.19.0"
             # Optional gem for LDAP authentication
             group :ldap do
               gem "net-ldap", "~> 0.12.0"
             end
             # Optional gem for OpenID authentication
             group :openid do
               gem "ruby-openid", "~> 2.3.0", :require => "openid"
               gem "rack-openid"
             end
             platforms :mri, :mingw, :x64_mingw do
               # Optional gem for exporting the gantt to a PNG file, not supported with jruby
               group :rmagick do
                 gem "rmagick", ">= 2.14.0"
               end
               # Optional Markdown support, not for JRuby
               group :markdown do
                 gem "redcarpet", "~> 3.3.2"
               end
             end
             platforms :jruby do
               # jruby-openssl is bundled with JRuby 1.7.0
               gem "jruby-openssl" if Object.const_defined?(:JRUBY_VERSION) && JRUBY_VERSION < '1.7.0'
               gem "activerecord-jdbc-adapter", "~> 1.3.2"
             end
             # Include database gems for the adapters found in the database
             # configuration file
             require 'erb'
             require 'yaml'
             database_file = File.join(File.dirname(__FILE__), "config/database.yml")
             if File.exist?(database_file)
               database_config = YAML::load(ERB.new(IO.read(database_file)).result)
               adapters = database_config.values.map {|c| c['adapter']}.compact.uniq
               if adapters.any?
                 adapters.each do |adapter|
                   case adapter
                   when 'mysql2'
                     gem "mysql2", "~> 0.3.11", :platforms => [:mri, :mingw, :x64_mingw]
                     gem "activerecord-jdbcmysql-adapter", :platforms => :jruby
                   when 'mysql'
                     gem "activerecord-jdbcmysql-adapter", :platforms => :jruby
                   when /postgresql/
                     gem "pg", "~> 0.18.1", :platforms => [:mri, :mingw, :x64_mingw]
                     gem "activerecord-jdbcpostgresql-adapter", :platforms => :jruby
                   when /sqlite3/
                     gem "sqlite3", :platforms => [:mri, :mingw, :x64_mingw]
                     gem "jdbc-sqlite3", ">= 3.8.10.1", :platforms => :jruby
                     gem "activerecord-jdbcsqlite3-adapter", :platforms => :jruby
                   when /sqlserver/
                     gem "tiny_tds", "~> 0.6.2", :platforms => [:mri, :mingw, :x64_mingw]
                     gem "activerecord-sqlserver-adapter", :platforms => [:mri, :mingw, :x64_mingw]
                   else
                     warn("Unknown database adapter `#{adapter}` found in config/database.yml, use Gemfile.local to load your own database gems")
                   end
                 end
               else
                 warn("No adapter found in config/database.yml, please configure it first")
               end
             else
               warn("Please configure your config/database.yml first")
             end
             group :development do
               gem "rdoc", ">= 2.4.2"
               gem "yard"
             end
             group :test do
               gem "minitest"
               gem "rails-dom-testing"
               gem "mocha"
               gem "simplecov", "~> 0.9.1", :require => false
               # For running UI tests
               gem "capybara"
               gem "selenium-webdriver"
             end
             local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
             if File.exists?(local_gemfile)
               eval_gemfile local_gemfile
             end
             # Load plugins' Gemfiles
             Dir.glob File.expand_path("../plugins/*/{Gemfile,PluginGemfile}", __FILE__) do |file|
               eval_gemfile file
             end

lib/redmine/thumbnail.rb +5 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'fileutils'
+            require 'mimemagic'
             module Redmine
               module Thumbnail
                 extend Redmine::Utils::Shell
                 CONVERT_BIN = (Redmine::Configuration['imagemagick_convert_command'] || 'convert').freeze
                 # Generates a thumbnail for the source image to target
                 def self.generate(source, target, size)
                   return nil unless convert_available?
                   unless File.exists?(target)
+                    # Make sure we only invoke Imagemagick if this is actually an image
+                    unless File.open(source) {|f| MimeMagic.by_magic(f).try(:image?)}
+                      return nil
+                    end
                     directory = File.dirname(target)
                     unless File.exists?(directory)
                       FileUtils.mkdir_p directory
                     end
                     size_option = "#{size}x#{size}>"
                     cmd = "#{shell_quote CONVERT_BIN} #{shell_quote source} -thumbnail #{shell_quote size_option} #{shell_quote target}"
                     unless system(cmd)
                       logger.error("Creating thumbnail failed (#{$?}):\nCommand: #{cmd}")
                       return nil
                     end
                   end
                   target
                 end
                 def self.convert_available?
                   return @convert_available if defined?(@convert_available)
                   @convert_available = system("#{shell_quote CONVERT_BIN} -version") rescue false
                   logger.warn("Imagemagick's convert binary (#{CONVERT_BIN}) not available") unless @convert_available
                   @convert_available
                 end
                 def self.logger
                   Rails.logger
                 end
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages