[BUGFIX] Disallow file preview for image/svg+xml files

[jirafeau.git] / lib / functions.js.php

diff --git a/lib/functions.js.php b/lib/functions.js.php
index 73e901f2b28607760b812bde4fafc0b47a334574..14fad1da5fa98eadc2473c90cba890ad6161cba3 100644 (file)
--- a/lib/functions.js.php
+++ b/lib/functions.js.php
@@ -182,16 +182,17 @@ function show_link (reference, delete_code, crypt_key, date)
         }
 
         // Test if content can be previewed
-         type = document.getElementById('file_select').files[0].type;
-         if (type.indexOf("image") > -1 ||
-             type.indexOf("audio") > -1 ||
-             type.indexOf("text") > -1 ||
-             type.indexOf("video") > -1)
-         {
+        type = document.getElementById('file_select').files[0].type;
+        if ((type.startsWith('image/')
+                || type.startsWith('audio')
+                || type.startsWith('text/plain')
+                || type.startsWith('video/'))
+            && !type.includes('image/svg+xml'))
+        {
             document.getElementById('preview_link').href = preview_link_href;
             document.getElementById('preview_link_text').innerHTML = web_root + preview_link_href;
             document.getElementById('upload_finished_preview').style.display = '';
-         }
+        }
     }
 
     // Direct download link
@@ -273,12 +274,18 @@ function control_selected_file_size(max_size, error_str)
     }
 }
 
+function XHRErrorHandler(e)
+{
+    var text = "${e.type}: ${e.loaded} bytes transferred"
+    console.log(text)
+}
+
 function pop_failure (e)
 {
-    var text = "An error occured";
+    var text = "<p>An error occured";
     if (typeof e !== 'undefined')
-        text = e;
-    text = "<p>" + text + "</p>";
+        text += ": " + e;
+    text += "</p>";
     document.getElementById('error_pop').innerHTML = e;
 
     document.getElementById('uploading').style.display = 'none';
@@ -339,8 +346,8 @@ function classic_upload (file, time, password, one_time, upload_password)
 
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", upload_progress, false);
-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
@@ -370,6 +377,10 @@ function classic_upload (file, time, password, one_time, upload_password)
 
             show_link (res[0], res[1], res[2], expiryDate);
         }
+        else
+        {
+            pop_failure ("<?php echo t("ERR_OCC"); ?>");
+        }
     }
     req.open ("POST", 'script.php' , true);
 
@@ -408,8 +419,8 @@ function async_upload_start (max_size, file, time, password, one_time, upload_pa
     async_global_time = time;
 
     var req = new XMLHttpRequest ();
-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
@@ -480,8 +491,8 @@ function async_upload_push (code)
     }
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", async_upload_progress, false);
-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4)
@@ -490,7 +501,16 @@ function async_upload_push (code)
             {
                 var res = req.responseText;
 
-                if (/^Error/.test(res))
+                // This error may be triggered when Jirafeau does not receive any file in POST.
+                // This may be due to bad php configuration where post_max_size is too low
+                // comparing to upload_max_filesize. Let's retry with lower file size.
+                if (res === "Error 23")
+                {
+                    async_global_max_size = Math.max(1, async_global_max_size - 500);
+                    async_upload_push (async_global_last_code);
+                    return;
+                }
+                else if (/^Error/.test(res))
                 {
                     pop_failure (res);
                     return;
@@ -500,12 +520,17 @@ function async_upload_push (code)
                 var code = res[0]
                 async_global_transfered = async_global_transfering;
                 async_upload_push (code);
+                return;
             }
-            else if (req.status == 413) // Request Entity Too Large
+            else
             {
-                // lower async_global_max_size and retry
-                async_global_max_size = parseInt (async_global_max_size * 0.8);
+                if (req.status == 413) // Request Entity Too Large
+                {
+                    // lower async_global_max_size and retry
+                    async_global_max_size = Math.max(1, parseInt (async_global_max_size * 0.8));
+                }
                 async_upload_push (async_global_last_code);
+                return;
             }
         }
     }
@@ -528,8 +553,8 @@ function async_upload_push (code)
 function async_upload_end (code)
 {
     var req = new XMLHttpRequest ();
-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
@@ -570,8 +595,7 @@ function upload (max_size)
 {
     var one_time_checkbox = document.getElementById('one_time_download');
     var one_time = one_time_checkbox !== null ? one_time_checkbox.checked : false;
-    if (check_html5_file_api ()
-        && document.getElementById('file_select').files[0].size >= max_size)
+    if (check_html5_file_api ())
     {
         async_upload_start (
             max_size,