Dominik Schmidt
65f19b5d71
fix(thumbnails): close rejected vips ref, map oversized convert error to forbidden
2026-09-08 15:28:37 +02:00
Dominik Schmidt
7f687ea288
fix(thumbnails): bound declared image dimensions before decoding
...
The imaging build decodes the full pixel buffer from the header-declared
dimensions before the existing MaxInputWidth/MaxInputHeight guard runs, so a
tiny crafted file whose header declares huge dimensions forces a multi-GB
allocation and can OOM the worker. Read the header with DecodeConfig and reject
oversized sources before the decode allocates, in both the imaging and vips
builds, and thread the limit through the audio cover-art and geogebra decoders
that decode a second attacker-controlled image.
2026-09-08 15:28:37 +02:00
Florian Schade
288e67cc39
chore: replace interface with any
2026-04-23 09:31:11 +02:00
Florian Schade
9c651af32d
fix(thumbnailer): missing font panic
2025-12-31 12:17:11 +01:00
Michael Barz
3b27d8f580
change: use 404 as status when thumbnail can not be fetched ( #1582 )
2025-09-30 20:40:31 +02:00
Ralf Haferkamp
c46e0c4b6b
Fix build with go 1.24
...
Go 1.24 does some stricter checks now on arguments to functions
accepting format strings.
This commit fixes a couple of "non-constant format string in call
to ..." errors when running the unit tests.
2025-03-10 10:43:34 +01:00
André Duffeck
e8d35e1280
Use the opencloud reva from now on
2025-01-21 11:16:38 +01:00
André Duffeck
8c8cdd9310
Adapt protobuf naming
2025-01-15 11:04:32 +01:00
Jörn Friedrich Dreyer
b07b5a1149
use plain pkg module
...
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de >
2025-01-13 16:42:19 +01:00
Jörn Friedrich Dreyer
8e028f17e9
change module name
...
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de >
2025-01-13 09:58:18 +01:00
Ralf Haferkamp
e0cf17d5e5
Fix thumbnails status code
...
Return 403 instead of 500 when the image is too large (in dimensions or file
size).
Fixes : #10589
2024-11-18 16:18:18 +01:00
Ralf Haferkamp
0b53c48bd9
fix(thumbnails): don't re-create thumbnails if they already exist
...
A previous cleanup introduced a bug which caused thumbnails to be
re-created even if we already had a matching thumbnail in the storage.
2024-10-08 10:37:36 +02:00
Ralf Haferkamp
86fa6a9cde
Revert "remove obsolete var"
...
This reverts commit a145c36fd5
2024-10-08 10:37:36 +02:00
Ralf Haferkamp
109b23966c
bump some jwt related go modules to current version
...
go-jwt/jwt to v5.2.1
MicahParks/keyfunc to v2.1.0
2024-08-26 15:35:15 +02:00
Christian Richter
a145c36fd5
remove obsolete var
...
Signed-off-by: Christian Richter <crichter@owncloud.com >
2024-06-04 12:10:01 +02:00
Christian Richter
db308bea5c
try to remove code duplications
...
Signed-off-by: Christian Richter <crichter@owncloud.com >
2024-06-04 11:24:55 +02:00
Christian Richter and Julian Koberg
1012a399ae
Don't show thumbnails for secureview shares
...
Co-authored-by: Julian Koberg <jkoberg@owncloud.com >
Signed-off-by: Christian Richter <crichter@owncloud.com >
2024-06-03 14:04:46 +02:00
Thomas Müller
9db3fd028e
feat: add maximum image dimension to be processed by the thumbnailer ( #9035 )
...
* feat: add maximum image dimension to be processed by the thumbnailer
* chore: make golangci-lint happy
2024-05-03 12:20:27 +02:00
jkoberg
a3044d1dd2
fix: pass signature and expiration through thumbnailer
...
Signed-off-by: jkoberg <jkoberg@owncloud.com >
2024-03-11 13:54:07 +01:00
Florian Schade and Martin
9abcd8a7f3
feature(thumbnails): add the ability to define custom image processors ( #7409 )
...
* feature(thumbnails): add the ability to define custom image processors
* fix(ci): add exported member comment
* docs(thumbnails): mention processors in readme
* fix: codacy and code review feedback
* fix: thumbnail readme markdown
Co-authored-by: Martin <github@diemattels.at >
---------
Co-authored-by: Martin <github@diemattels.at >
2023-10-17 09:44:44 +02:00
case0sh
ace3664f6a
fix formatting
2023-10-06 10:29:08 +02:00
Daniël Franke
f4c16811a5
Convert thumbnails to service trace provider
...
This converts the thumbnails service to use the service trace provider.
2023-07-31 11:13:34 +02:00
Daniel Swärd
571d2318c0
Add missing span kind for tracing. ( #6471 )
...
* Add missing span kind for tracing.
* Add missing spanKind for tracing.
2023-06-22 10:09:10 +02:00
Florian Schade and Ralf Haferkamp
4f26424db6
[full-ci] enhancement: use reva client pool selectors ( #6452 )
...
* enhancement: use reva client pool selectors
register mock service to registry and pass tests
* enhancement: bump reva
* Fix a couple of linter issues
---------
Co-authored-by: Ralf Haferkamp <rhaferkamp@owncloud.com >
2023-06-08 12:41:04 +02:00
Roman Perekhod and Roman Perekhod
e57e6046d3
Fix preview or viewing of shared animated GIFs ( #6386 )
...
* Fix preview or viewing of shared animated GIFs
---------
Co-authored-by: Roman Perekhod <rperekhod@owncloud.com >
2023-05-26 14:52:12 +02:00
jkoberg
48ffc19554
return 425 on thumbnails when file is processing
...
Signed-off-by: jkoberg <jkoberg@owncloud.com >
2022-12-28 15:40:35 +01:00
David Christofas
efe1fc52e0
fix nilerr bugs
2022-12-21 14:45:50 +01:00
Christian Richter
f8f1320501
refactor extensions -> services
...
Signed-off-by: Christian Richter <crichter@owncloud.com >
2022-06-27 14:05:36 +02:00
Christian Richter
78064e6bab
rename folder extensions -> services
...
Signed-off-by: Christian Richter <crichter@owncloud.com >
2022-06-27 14:05:36 +02:00
Dominik Schmidt