jro_apps/redmine Commit - r14980:bf81c96b79cc

Make sure we only invoke Imagemagick if this is actually an image (#22721)....

Jean-Philippe Lang -

r14980:bf81c96b79cc

parent child

Context file:

r14980:bf81c96b79cc

Collapse all files

Gemfile +1 0

              source 'https://rubygems.org'
              if Gem::Version.new(Bundler::VERSION) < Gem::Version.new('1.5.0')
                abort "Redmine requires Bundler 1.5.0 or higher (you're using #{Bundler::VERSION}).\nPlease update with 'gem update bundler'."
              end
              gem "rails", "4.2.6"
              gem "jquery-rails", "~> 3.1.4"
              gem "coderay", "~> 1.1.0"
              gem "builder", ">= 3.0.4"
              gem "request_store", "1.0.5"
              gem "mime-types", (RUBY_VERSION >= "2.0" ? "~> 3.0" : "~> 2.99")
              gem "protected_attributes"
              gem "actionpack-action_caching"
              gem "actionpack-xml_parser"
              gem "roadie-rails"
+             gem "mimemagic"
              # Request at least nokogiri 1.6.7.2 because of security advisories
              gem "nokogiri", ">= 1.6.7.2"
              # Request at least rails-html-sanitizer 1.0.3 because of security advisories
              gem "rails-html-sanitizer", ">= 1.0.3"
              # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
              gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin, :jruby]
              gem "rbpdf", "~> 1.19.0"
              # Optional gem for LDAP authentication
              group :ldap do
                gem "net-ldap", "~> 0.12.0"
              end
              # Optional gem for OpenID authentication
              group :openid do
                gem "ruby-openid", "~> 2.3.0", :require => "openid"
                gem "rack-openid"
              end
              platforms :mri, :mingw, :x64_mingw do
                # Optional gem for exporting the gantt to a PNG file, not supported with jruby
                group :rmagick do
                  gem "rmagick", ">= 2.14.0"
                end
                # Optional Markdown support, not for JRuby
                group :markdown do
                  gem "redcarpet", "~> 3.3.2"
                end
              end
              platforms :jruby do
                # jruby-openssl is bundled with JRuby 1.7.0
                gem "jruby-openssl" if Object.const_defined?(:JRUBY_VERSION) && JRUBY_VERSION < '1.7.0'
                gem "activerecord-jdbc-adapter", "~> 1.3.2"
              end
              # Include database gems for the adapters found in the database
              # configuration file
              require 'erb'
              require 'yaml'
              database_file = File.join(File.dirname(__FILE__), "config/database.yml")
              if File.exist?(database_file)
                database_config = YAML::load(ERB.new(IO.read(database_file)).result)
                adapters = database_config.values.map {|c| c['adapter']}.compact.uniq
                if adapters.any?
                  adapters.each do |adapter|
                    case adapter
                    when 'mysql2'
                      gem "mysql2", "~> 0.3.11", :platforms => [:mri, :mingw, :x64_mingw]
                      gem "activerecord-jdbcmysql-adapter", :platforms => :jruby
                    when 'mysql'
                      gem "activerecord-jdbcmysql-adapter", :platforms => :jruby
                    when /postgresql/
                      gem "pg", "~> 0.18.1", :platforms => [:mri, :mingw, :x64_mingw]
                      gem "activerecord-jdbcpostgresql-adapter", :platforms => :jruby
                    when /sqlite3/
                      gem "sqlite3", :platforms => [:mri, :mingw, :x64_mingw]
                      gem "jdbc-sqlite3", ">= 3.8.10.1", :platforms => :jruby
                      gem "activerecord-jdbcsqlite3-adapter", :platforms => :jruby
                    when /sqlserver/
                      gem "tiny_tds", "~> 0.6.2", :platforms => [:mri, :mingw, :x64_mingw]
                      gem "activerecord-sqlserver-adapter", :platforms => [:mri, :mingw, :x64_mingw]
                    else
                      warn("Unknown database adapter `#{adapter}` found in config/database.yml, use Gemfile.local to load your own database gems")
                    end
                  end
                else
                  warn("No adapter found in config/database.yml, please configure it first")
                end
              else
                warn("Please configure your config/database.yml first")
              end
              group :development do
                gem "rdoc", ">= 2.4.2"
                gem "yard"
              end
              group :test do
                gem "minitest"
                gem "rails-dom-testing"
                gem "mocha"
                gem "simplecov", "~> 0.9.1", :require => false
                # For running UI tests
                gem "capybara"
                gem "selenium-webdriver"
              end
              local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
              if File.exists?(local_gemfile)
                eval_gemfile local_gemfile
              end
              # Load plugins' Gemfiles
              Dir.glob File.expand_path("../plugins/*/{Gemfile,PluginGemfile}", __FILE__) do |file|
                eval_gemfile file
              end

lib/redmine/thumbnail.rb +5 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require 'fileutils'
+             require 'mimemagic'
              module Redmine
                module Thumbnail
                  extend Redmine::Utils::Shell
                  CONVERT_BIN = (Redmine::Configuration['imagemagick_convert_command'] || 'convert').freeze
                  # Generates a thumbnail for the source image to target
                  def self.generate(source, target, size)
                    return nil unless convert_available?
                    unless File.exists?(target)
+                     # Make sure we only invoke Imagemagick if this is actually an image
+                     unless File.open(source) {|f| MimeMagic.by_magic(f).try(:image?)}
+                       return nil
+                     end
                      directory = File.dirname(target)
                      unless File.exists?(directory)
                        FileUtils.mkdir_p directory
                      end
                      size_option = "#{size}x#{size}>"
                      cmd = "#{shell_quote CONVERT_BIN} #{shell_quote source} -thumbnail #{shell_quote size_option} #{shell_quote target}"
                      unless system(cmd)
                        logger.error("Creating thumbnail failed (#{$?}):\nCommand: #{cmd}")
                        return nil
                      end
                    end
                    target
                  end
                  def self.convert_available?
                    return @convert_available if defined?(@convert_available)
                    @convert_available = system("#{shell_quote CONVERT_BIN} -version") rescue false
                    logger.warn("Imagemagick's convert binary (#{CONVERT_BIN}) not available") unless @convert_available
                    @convert_available
                  end
                  def self.logger
                    Rails.logger
                  end
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages