From: Tim Otten <totten@civicrm.org>
Date: Wed, 30 Apr 2014 19:50:49 +0000 (-0700)
Subject: CRM-14499 - ImageFile - Fix photo URL validation on WP
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=f2b3f5966b2919767e08a716904682f543a576e8;p=civicrm-core.git

CRM-14499 - ImageFile - Fix photo URL validation on WP

----------------------------------------
* CRM-14499: Upgrade to 4.4.5 causes contact photos to be unviewable
  https://issues.civicrm.org/jira/browse/CRM-14499
---

diff --git a/CRM/Contact/Page/ImageFile.php b/CRM/Contact/Page/ImageFile.php
index f0aa6f9915..40731b6320 100644
--- a/CRM/Contact/Page/ImageFile.php
+++ b/CRM/Contact/Page/ImageFile.php
@@ -33,28 +33,34 @@
  *
  */
 class CRM_Contact_Page_ImageFile extends CRM_Core_Page {
-  function run(){
-    $currentURL = CRM_Utils_System::makeURL(NULL, FALSE, FALSE, NULL, TRUE);
-    $sql = "SELECT id FROM civicrm_contact WHERE image_url=%1;";
-    $params = array(1 => array($currentURL, 'String'));
+  function run() {
+    if (!preg_match('/^[^\/]+\.(jpg|jpeg|png|gif)$/i', $_GET['photo'])) {
+      CRM_Core_Error::fatal('Malformed photo name');
+    }
+
+    // FIXME Optimize performance of image_url query
+    $sql = "SELECT id FROM civicrm_contact WHERE image_url like %1;";
+    $params = array(
+      1 => array("%" . $_GET['photo'], 'String')
+    );
     $dao = CRM_Core_DAO::executeQuery($sql, $params);
-    while ($dao->fetch()){
-      $cid=$dao->id;
+    while ($dao->fetch()) {
+      $cid = $dao->id;
     }
-    if ($cid){
-       $config = CRM_Core_Config::singleton();
-       $buffer = file_get_contents($config->customFileUploadDir . $_GET['photo']);
-       $mimeType = 'image/' .pathinfo($_GET['photo'], PATHINFO_EXTENSION);
-       CRM_Utils_System::download($_GET['photo'], $mimeType, $buffer,
+    if ($cid) {
+      $config = CRM_Core_Config::singleton();
+      $buffer = file_get_contents($config->customFileUploadDir . $_GET['photo']);
+      $mimeType = 'image/' . pathinfo($_GET['photo'], PATHINFO_EXTENSION);
+      CRM_Utils_System::download($_GET['photo'], $mimeType, $buffer,
         NULL,
-        TRUE, 
-       'inline'
+        TRUE,
+        'inline'
       );
+      CRM_Utils_System::civiExit();
     }
-    else{
-      echo 'image url not in database';
+    else {
+      CRM_Core_Error::fatal('Photo does not exist');
     }
-    CRM_Utils_System::civiExit();     
   }
 }