Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Be more strict when checking if mimetype is allowed inline. #1724

Merged
merged 3 commits into from
Oct 28, 2023
Merged

Be more strict when checking if mimetype is allowed inline. #1724

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d7aede2
Be more strict when checking if mimetype is allowed to be displayed i…
mauritsvanrees Oct 27, 2023
bfc79a7
Copy a test for extract_media_type from Zope.
mauritsvanrees Oct 27, 2023
43890f0
Rename extract_media_type to _extract_media_type to signal it as priv…
mauritsvanrees Oct 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions news/1167.bugfix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Be more strict when checking if mimetype is allowed to be displayed inline.
[maurits]
26 changes: 23 additions & 3 deletions src/plone/restapi/services/users/get.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,28 @@

DEFAULT_SEARCH_RESULTS_LIMIT = 25

try:
from OFS.Image import extract_media_type
except ImportError:
try:
from plone.namedfile.utils import extract_media_type
except ImportError:

def extract_media_type(content_type):
"""extract the proper media type from *content_type*.

Ignore parameters and whitespace and normalize to lower case.
See https://github.com/zopefoundation/Zope/pull/1167
"""
if not content_type:
return content_type
# ignore parameters
content_type = content_type.split(";", 1)[0]
# ignore whitespace
content_type = "".join(content_type.split())
# normalize to lowercase
return content_type.lower()


def getPortraitUrl(user):
if not user:
Expand Down Expand Up @@ -84,7 +106,6 @@ def _sort_users(users: Iterable[MemberData]) -> Sequence[MemberData]:
def _principal_search_results(
self, search_for_principal, get_principal_by_id, principal_type, id_key
):

hunter = getMultiAdapter((self.context, self.request), name="pas_search")

principals = []
Expand Down Expand Up @@ -209,7 +230,6 @@ def reply(self):
if self.has_permission_to_access_user_info() or (
current_user_id and current_user_id == self._get_user_id
):

# we retrieve the user on the user id not the username
user = self._get_user(self._get_user_id)
if not user:
Expand Down Expand Up @@ -251,7 +271,7 @@ def _get_user_id(self):

def _should_force_download(self, portrait):
# If this returns True, the caller should set the Content-Disposition header.
mimetype = portrait.content_type
mimetype = extract_media_type(portrait.content_type)
if not mimetype:
return False
if self.use_denylist:
Expand Down