[BUGFIX] Disallow file preview for image/svg+xml files

[jirafeau.git] / lib / functions.js.php

diff --git a/lib/functions.js.php b/lib/functions.js.php
index ced2fa7b5e6bdbd06bfad4c0046c71c92779fb53..14fad1da5fa98eadc2473c90cba890ad6161cba3 100644 (file)
--- a/lib/functions.js.php
+++ b/lib/functions.js.php
@@ -182,16 +182,17 @@ function show_link (reference, delete_code, crypt_key, date)
         }
 
         // Test if content can be previewed
         }
 
         // Test if content can be previewed

-         type = document.getElementById('file_select').files[0].type;
-         if (type.indexOf("image") > -1 ||
-             type.indexOf("audio") > -1 ||
-             type.indexOf("text") > -1 ||
-             type.indexOf("video") > -1)
-         {
+        type = document.getElementById('file_select').files[0].type;
+        if ((type.startsWith('image/')
+                || type.startsWith('audio')
+                || type.startsWith('text/plain')
+                || type.startsWith('video/'))
+            && !type.includes('image/svg+xml'))
+        {

             document.getElementById('preview_link').href = preview_link_href;
             document.getElementById('preview_link_text').innerHTML = web_root + preview_link_href;
             document.getElementById('upload_finished_preview').style.display = '';
             document.getElementById('preview_link').href = preview_link_href;
             document.getElementById('preview_link_text').innerHTML = web_root + preview_link_href;
             document.getElementById('upload_finished_preview').style.display = '';

-         }
+        }

     }
 
     // Direct download link
     }
 
     // Direct download link


@@ -273,12 +274,18 @@ function control_selected_file_size(max_size, error_str)
     }
 }
 
     }
 }
 

+function XHRErrorHandler(e)
+{
+    var text = "${e.type}: ${e.loaded} bytes transferred"
+    console.log(text)
+}
+

 function pop_failure (e)
 {
 function pop_failure (e)
 {

-    var text = "An error occured";
+    var text = "<p>An error occured";

     if (typeof e !== 'undefined')
     if (typeof e !== 'undefined')

-        text = e;
-    text = "<p>" + text + "</p>";
+        text += ": " + e;
+    text += "</p>";

     document.getElementById('error_pop').innerHTML = e;
 
     document.getElementById('uploading').style.display = 'none';
     document.getElementById('error_pop').innerHTML = e;
 
     document.getElementById('uploading').style.display = 'none';


@@ -339,8 +346,8 @@ function classic_upload (file, time, password, one_time, upload_password)
 
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", upload_progress, false);
 
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", upload_progress, false);

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)


@@ -412,8 +419,8 @@ function async_upload_start (max_size, file, time, password, one_time, upload_pa
     async_global_time = time;
 
     var req = new XMLHttpRequest ();
     async_global_time = time;
 
     var req = new XMLHttpRequest ();

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)


@@ -484,8 +491,8 @@ function async_upload_push (code)
     }
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", async_upload_progress, false);
     }
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", async_upload_progress, false);

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4)


@@ -546,8 +553,8 @@ function async_upload_push (code)
 function async_upload_end (code)
 {
     var req = new XMLHttpRequest ();
 function async_upload_end (code)
 {
     var req = new XMLHttpRequest ();

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)