From 2bf51c7b9eee1da51e7c0f7a5cbcd76d06fdc9fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Julius=20H=C3=A4rtl?= <jus@bitgrid.net>
Date: Thu, 17 May 2018 11:24:19 +0200
Subject: [PATCH] Properly check mime type of the uploaded file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Julius Härtl <jus@bitgrid.net>
---
 apps/theming/lib/Controller/ThemingController.php   |  5 +++--
 .../tests/Controller/ThemingControllerTest.php      | 13 +++++++------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/apps/theming/lib/Controller/ThemingController.php b/apps/theming/lib/Controller/ThemingController.php
index 421af051998..5e1e3d08dc9 100644
--- a/apps/theming/lib/Controller/ThemingController.php
+++ b/apps/theming/lib/Controller/ThemingController.php
@@ -248,8 +248,9 @@ class ThemingController extends Controller {
 		}
 
 		$target = $folder->newFile($key);
-		$supportedFormats = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml', 'text/svg'];
-		if (!in_array($image['type'], $supportedFormats)) {
+		$supportedFormats = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml', 'image/svg'];
+		$detectedMimeType = mime_content_type($image['tmp_name']);
+		if (!in_array($image['type'], $supportedFormats) || !in_array($detectedMimeType, $supportedFormats)) {
 			return new DataResponse(
 				[
 					'data' => [
diff --git a/apps/theming/tests/Controller/ThemingControllerTest.php b/apps/theming/tests/Controller/ThemingControllerTest.php
index dda881525f0..6d756c13a5a 100644
--- a/apps/theming/tests/Controller/ThemingControllerTest.php
+++ b/apps/theming/tests/Controller/ThemingControllerTest.php
@@ -255,7 +255,7 @@ class ThemingControllerTest extends TestCase {
 			->method('getUploadedFile')
 			->with('image')
 			->willReturn([
-				'tmp_name' => 'logo.pdf',
+				'tmp_name' => __DIR__  . '/../../../../tests/data/lorem.txt',
 				'type' => 'application/pdf',
 				'name' => 'logo.pdf',
 				'error' => 0,
@@ -295,7 +295,7 @@ class ThemingControllerTest extends TestCase {
 			['image/gif'],
 			['image/png'],
 			['image/svg+xml'],
-			['text/svg'],
+			['image/svg']
 		];
 	}
 
@@ -305,6 +305,7 @@ class ThemingControllerTest extends TestCase {
 		$destination = \OC::$server->getTempManager()->getTemporaryFolder();
 
 		touch($tmpLogo);
+		copy(__DIR__ . '/../../../../tests/data/testimagelarge.svg', $tmpLogo);
 		$this->request
 			->expects($this->at(0))
 			->method('getParam')
@@ -377,10 +378,10 @@ class ThemingControllerTest extends TestCase {
 
 	/** @dataProvider dataUpdateImages */
 	public function testUpdateLogoLoginScreenUpload($folderExists) {
-		$tmpLogo = \OC::$server->getTempManager()->getTemporaryFolder() . '/logo.svg';
+		$tmpLogo = \OC::$server->getTempManager()->getTemporaryFolder() . 'logo.png';
 
 		touch($tmpLogo);
-		file_put_contents($tmpLogo, file_get_contents(__DIR__  . '/../../../../tests/data/desktopapp.png'));
+		copy(__DIR__ . '/../../../../tests/data/desktopapp.png', $tmpLogo);
 		$this->request
 			->expects($this->at(0))
 			->method('getParam')
@@ -392,7 +393,7 @@ class ThemingControllerTest extends TestCase {
 			->with('image')
 			->willReturn([
 				'tmp_name' => $tmpLogo,
-				'type' => 'text/svg',
+				'type' => 'image/svg+xml',
 				'name' => 'logo.svg',
 				'error' => 0,
 			]);
@@ -524,7 +525,7 @@ class ThemingControllerTest extends TestCase {
 			->with('image')
 			->willReturn([
 				'tmp_name' => '',
-				'type' => 'text/svg',
+				'type' => 'image/svg+xml',
 				'name' => 'logo.svg',
 				'error' => $error,
 			]);