Merge pull request #32792 from nextcloud/backport/32675/stable23

[stable23] Validate custom dashboard background image
nextcloud · Jul 5, 2022 · 9d91248 · 9d91248
2 parents 0882642 + bb7b115
commit 9d91248
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apps/dashboard/lib/Service/BackgroundService.php b/apps/dashboard/lib/Service/BackgroundService.php
@@ -149,6 +149,10 @@ public function setFileBackground($path): void {
 		$userFolder = $this->rootFolder->getUserFolder($this->userId);
 		/** @var File $file */
 		$file = $userFolder->get($path);
+		$image = new \OCP\Image();
+		if ($image->loadFromFileHandle($file->fopen('r')) === false) {
+			throw new InvalidArgumentException('Invalid image file');
+		}
 		$this->getAppDataFolder()->newFile('background.jpg', $file->fopen('r'));
 	}