CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-04 15:04:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate image size in pixels at upload time (#3003)

Browse Source
This commit is contained in:
Raphael Michel
2023-01-12 16:30:28 +01:00
committed by GitHub
parent 738301d2af
commit 9dd3b12625
16 changed files with 226 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/tests/api/test_cart.py
View File

@@ -29,6 +29,7 @@ from django.core.files.base import ContentFile
from django.utils.timezone import now
from django_scopes import scopes_disabled
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.base.models import Question, SeatingPlan
from pretix.base.models.orders import CartPosition
@@ -467,7 +468,7 @@ def test_cartpos_create_answer_validation(token_client, organizer, event, item,
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

3
src/tests/api/test_checkin.py
View File

@@ -32,6 +32,7 @@ from django_countries.fields import Country
from django_scopes import scopes_disabled
from i18nfield.strings import LazyI18nString
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.api.serializers.item import QuestionSerializer
from pretix.base.models import (
@@ -1057,7 +1058,7 @@ def test_question_upload(token_client, organizer, clist, event, order, question)
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

3
src/tests/api/test_checkinrpc.py
View File

@@ -30,6 +30,7 @@ from django_countries.fields import Country
from django_scopes import scopes_disabled
from i18nfield.strings import LazyI18nString
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.api.serializers.item import QuestionSerializer
from pretix.base.models import Checkin, InvoiceAddress, Order, OrderPosition
@@ -563,7 +564,7 @@ def test_question_upload(token_client, organizer, clist, event, order, question)
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

5
src/tests/api/test_events.py
View File

@@ -44,6 +44,7 @@ from django.utils.timezone import now
from django_countries.fields import Country
from django_scopes import scopes_disabled
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.base.models import (
Event, InvoiceAddress, Order, OrderPosition, Organizer, SeatingPlan,
@@ -1351,7 +1352,7 @@ def test_patch_event_settings_file(token_client, organizer, event):
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
@@ -1363,7 +1364,7 @@ def test_patch_event_settings_file(token_client, organizer, event):
'/api/v1/upload',
data={
'media_type': 'application/pdf',
'file': ContentFile('file.pdf', 'invalid pdf content')
'file': ContentFile('invalid pdf content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.pdf"',

5
src/tests/api/test_items.py
View File

@@ -43,6 +43,7 @@ from django.core.files.base import ContentFile
from django_countries.fields import Country
from django_scopes import scopes_disabled
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.base.channels import get_all_sales_channels
from pretix.base.models import (
@@ -1119,7 +1120,7 @@ def test_item_file_upload(token_client, organizer, event, item):
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
@@ -1143,7 +1144,7 @@ def test_item_file_upload(token_client, organizer, event, item):
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

3
src/tests/api/test_order_change.py
View File

@@ -31,6 +31,7 @@ from django.utils.timezone import now
from django_countries.fields import Country
from django_scopes import scopes_disabled
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.base.models import (
InvoiceAddress, Order, OrderPosition, Question, SeatingPlan,
@@ -1018,7 +1019,7 @@ def test_position_update_question_handling(token_client, organizer, event, order
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

3
src/tests/api/test_order_create.py
View File

@@ -32,6 +32,7 @@ from django.utils.timezone import now
from django_countries.fields import Country
from django_scopes import scopes_disabled
from pytz import UTC
from tests.const import SAMPLE_PNG
from pretix.base.models import (
InvoiceAddress, Order, OrderPosition, Question, SeatingPlan,
@@ -1424,7 +1425,7 @@ def test_order_create_answer_validation(token_client, organizer, event, item, qu
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',

5
src/tests/api/test_organizers.py
View File

@@ -21,6 +21,7 @@
#
import pytest
from django.core.files.base import ContentFile
from tests.const import SAMPLE_PNG
from pretix.testutils.mock import mocker_context
@@ -130,7 +131,7 @@ def test_patch_organizer_settings_file(token_client, organizer):
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('file.png', 'invalid png content')
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
@@ -142,7 +143,7 @@ def test_patch_organizer_settings_file(token_client, organizer):
'/api/v1/upload',
data={
'media_type': 'application/pdf',
'file': ContentFile('file.pdf', 'invalid pdf content')
'file': ContentFile('invalid pdf content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.pdf"',

75
src/tests/api/test_upload.py
View File

@@ -19,8 +19,14 @@
# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
# <https://www.gnu.org/licenses/>.
#
import io
import math
import pytest
from django.core.files.base import ContentFile
from PIL import Image
from PIL.Image import MAX_IMAGE_PIXELS
from tests.const import SAMPLE_PNG
@pytest.mark.django_db
@@ -29,7 +35,7 @@ def test_upload_file(token_client):
'/api/v1/upload',
data={
'media_type': 'application/pdf',
'file': ContentFile('file.pdf', 'invalid pdf content')
'file': ContentFile('invalid pdf content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.pdf"',
@@ -44,9 +50,74 @@ def test_upload_file_extension_mismatch(token_client):
'/api/v1/upload',
data={
'media_type': 'application/pdf',
'file': ContentFile('file.png', 'invalid pdf content')
'file': ContentFile('invalid pdf content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
)
assert r.status_code == 400
assert r.data == ['File name "file.png" has an invalid extension for type "application/pdf"']
@pytest.mark.django_db
def test_upload_file_extension_not_allowed(token_client):
r = token_client.post(
'/api/v1/upload',
data={
'media_type': 'application/octet-stream',
'file': ContentFile('invalid pdf content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.bin"',
)
assert r.status_code == 400
assert r.data == ['Content type "application/octet-stream" is not allowed']
@pytest.mark.django_db
def test_upload_invalid_image(token_client):
r = token_client.post(
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile('invalid png content')
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
)
assert r.status_code == 400
assert r.data == ['Upload a valid image. The file you uploaded was either not an image or a corrupted image.']
@pytest.mark.django_db
def test_upload_valid_image(token_client):
r = token_client.post(
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile(SAMPLE_PNG)
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
)
assert r.status_code == 201
@pytest.mark.django_db
@pytest.mark.filterwarnings("ignore")
def test_upload_image_with_invalid_dimensions(token_client):
d = int(math.sqrt(MAX_IMAGE_PIXELS)) + 100
img = Image.new('RGB', (d, d), color='red')
output = io.BytesIO()
img.save(output, format='PNG')
r = token_client.post(
'/api/v1/upload',
data={
'media_type': 'image/png',
'file': ContentFile(output.getvalue())
},
format='upload',
HTTP_CONTENT_DISPOSITION='attachment; filename="file.png"',
)
assert r.status_code == 400
assert r.data == ['The file you uploaded has a very large number of pixels, please upload a picture with smaller dimensions.']