View Issue Details

IDProjectCategoryView StatusLast Update
0004435mantisbtotherpublic2004-09-12 08:28
Reportervboctor Assigned Tovboctor  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Product Version0.19.0rc1 
Fixed in Version0.19.0 
Summary0004435: Auto-preview of attached images is broken
Description

The auto-preview feature was dependent on the file extension and size. Given the change in naming of attachment files as they are stored on the server, the files has no extension anymore and hence images are not auto-previewed.

The detection of the file type should not depend on the display name rather than the disk file name.

The problem is in core/file_api.php, line 88:
in_array( strtolower( file_get_extension( $v_diskfile ) ), array( 'png', 'jpg', 'gif', 'bmp' ), true )

See 0004434 for an example of an image that is not auto-previewed.

When this problem is fixed, the webserver will be patched, and hence, the previewing feature will work again.

TagsNo tags attached.
Attached Files
auto_preview.diff (1,633 bytes)   
Index: core/file_api.php
===================================================================
RCS file: /cvsroot/mantisbt/mantisbt/core/file_api.php,v
retrieving revision 1.53
diff -u -r1.53 file_api.php
--- core/file_api.php	27 Aug 2004 00:47:14 -0000	1.53
+++ core/file_api.php	30 Aug 2004 11:45:52 -0000
@@ -149,6 +149,7 @@
 			$row = db_fetch_array( $result );
 			extract( $row, EXTR_PREFIX_ALL, 'v' );
 
+			$t_file_display_name = file_get_display_name( $v_filename );
 			$t_filesize		= number_format( $v_filesize );
 			$t_date_added	= date( config_get( 'normal_date_format' ), db_unixtimestamp( $v_date_added ) );
 
@@ -170,8 +171,8 @@
 			}
 
 			PRINT $t_href_start;
-			print_file_icon ( file_get_display_name( $v_filename ) );
-			PRINT $t_href_end . '</a>&nbsp;' . $t_href_start . file_get_display_name( $v_filename ) .
+			print_file_icon ( $t_file_display_name );
+			PRINT $t_href_end . '</a>&nbsp;' . $t_href_start . $t_file_display_name .
 				$t_href_end . "$t_href_clicket ($t_filesize bytes) <span class=\"italic\">$t_date_added</span>";
 
 			if ( $t_can_delete ) {
@@ -185,7 +186,7 @@
 			if ( $t_can_download &&
 				( $v_filesize <= config_get( 'preview_attachments_inline_max_size' ) ) &&
 				( $v_filesize != 0 ) &&
-				( in_array( strtolower( file_get_extension( $v_diskfile ) ), array( 'png', 'jpg', 'gif', 'bmp' ), true ) ) ) {
+				( in_array( strtolower( file_get_extension( $t_file_display_name ) ), array( 'png', 'jpg', 'gif', 'bmp' ), true ) ) ) {
 
 				PRINT "<br /><img src=\"file_download.php?file_id=$v_id&amp;type=bug\" />";
 				$image_previewed = true;
auto_preview.diff (1,633 bytes)   

Relationships

related to 0003540 closedthraxisp Arbitrary code execution through uploads 

Activities

vboctor

vboctor

2004-08-30 06:49

manager   ~0007301

Fixed in CVS, and Mantis Bugtracker was patched.