Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
E
erp5_rtl_support
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Romain Courteaud
erp5_rtl_support
Commits
29493be5
Commit
29493be5
authored
Oct 14, 2015
by
Julien Muchembled
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
DMS: fix DoS in image conversion
parent
eedee92c
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
6 additions
and
0 deletions
+6
-0
product/ERP5/Document/Image.py
product/ERP5/Document/Image.py
+6
-0
No files found.
product/ERP5/Document/Image.py
View file @
29493be5
...
@@ -335,6 +335,11 @@ class Image(TextConvertableMixin, File, OFSImage):
...
@@ -335,6 +335,11 @@ class Image(TextConvertableMixin, File, OFSImage):
parameter_list
.
append
(
'-'
)
parameter_list
.
append
(
'-'
)
if
format
:
if
format
:
# Is there a way to make 'convert' fail if the format is unknown,
# instead of treating this whole parameter as an output file path?
# As a workaround, we run 'convert' in a non-writeable directory.
if
'/'
in
format
or
os
.
access
(
'/'
,
os
.
W_OK
):
raise
ConversionError
parameter_list
.
append
(
'%s:-'
%
format
)
parameter_list
.
append
(
'%s:-'
%
format
)
else
:
else
:
parameter_list
.
append
(
'-'
)
parameter_list
.
append
(
'-'
)
...
@@ -350,6 +355,7 @@ class Image(TextConvertableMixin, File, OFSImage):
...
@@ -350,6 +355,7 @@ class Image(TextConvertableMixin, File, OFSImage):
stdin
=
subprocess
.
PIPE
,
stdin
=
subprocess
.
PIPE
,
stdout
=
subprocess
.
PIPE
,
stdout
=
subprocess
.
PIPE
,
stderr
=
subprocess
.
PIPE
,
stderr
=
subprocess
.
PIPE
,
cwd
=
'/'
,
close_fds
=
True
)
close_fds
=
True
)
try
:
try
:
# XXX: The only portable way is to pass what stdin.write can accept,
# XXX: The only portable way is to pass what stdin.write can accept,
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment