[ofbiz-framework] branch release17.12 updated: Fixed: addImageForProduct fails (OFBIZ-12211)

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release17.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release17.12 by this push:
     new 9510fc9  Fixed: addImageForProduct fails (OFBIZ-12211)
9510fc9 is described below

commit 9510fc938950062b28daba5c9bf9f5ddd613a1ae
Author: Jacques Le Roux <[hidden email]>
AuthorDate: Mon Mar 29 11:07:20 2021 +0200

    Fixed: addImageForProduct fails (OFBIZ-12211)
   
    The addImageForProduct  process is not directly uploading a file but renames it
    before.So there is a hyphen, and possibly a pair or parenthesis in case of
    duplicate files, added to the file name.
   
    In this commit I have also added the possibility to use underscores and spaces
    in the original filename
---
 framework/common/config/SecurityUiLabels.xml       | 10 ++++----
 .../org/apache/ofbiz/security/SecuredUpload.java   | 28 +++++++++++++++-------
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/framework/common/config/SecurityUiLabels.xml b/framework/common/config/SecurityUiLabels.xml
index f337b8d..2e74e44 100644
--- a/framework/common/config/SecurityUiLabels.xml
+++ b/framework/common/config/SecurityUiLabels.xml
@@ -775,23 +775,23 @@
         <value xml:lang="zh-TW">SecurityViewPermissionError 你沒有權限檢視本頁面. (需要"SECURITY_VIEW" 或 "SECURITY_ADMIN")</value>
     </property>
     <property key="SupportedFileFormatsIncludingSvg">
-        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), SVG, PDF, and ZIP or text files with safe names (only Alpha-Numeric characters, only 1 dot, name and extension not empty) and contents are accepted.</value>
+        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), SVG, PDF, and ZIP or text files with safe names (only Alpha-Numeric characters, hyphen, underscore and spaces, only 1 dot, name and extension not empty) and contents are accepted.</value>
         <value xml:lang="fr">Pour des raisons de sécurité, seuls les fichiers valides de formats d'image pris en charge (GIF, JPEG, PNG, TIFF), les fichiers SVG, PDF, et les fichiers ZIP ou texte avec des noms sûrs (uniquement des caractères alphanumériques, 1 seul point, nom et extension non vides) et aux contenus sûrs sont acceptés.</value>
     </property>
      <property key="SupportedFileFormats">
-        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), PDF or text files with safe names (only Alpha-Numeric characters, only 1 dot, name and extension not empty) and contents are accepted.</value>
+        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), PDF or text files with safe names (only Alpha-Numeric characters, hyphen, underscore and spaces, only 1 dot, name and extension not empty) and contents are accepted.</value>
         <value xml:lang="fr">Pour des raisons de sécurité, seuls les fichiers valides de formats d'image pris en charge (GIF, JPEG, PNG, TIFF), les fichiers PDF ou les fichiers texte avec des noms sûrs (uniquement des caractères alphanumériques, 1 seul point, nom et extension non vides) et aux contenus sûrs sont acceptés.</value>
     </property>
     <property key="SupportedImageFormatsIncludingSvg">
-        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), or SVG format with safe names (only Alpha-Numeric characters, only 1 dot, name and extension not empty) are accepted.</value>
+        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF), or SVG format with safe names (only Alpha-Numeric characters, hyphen, underscore and spaces, only 1 dot, name and extension not empty) are accepted.</value>
         <value xml:lang="fr">Pour des raisons de sécurité, seuls les fichiers valides des formats d'image pris en charge (GIF, JPEG, PNG, TIFF) ou au format SVG avec des noms sûrs (uniquement des caractères alphanumériques, 1 seul point, nom et extension non vides) sont acceptés.</value>
     </property>
     <property key="SupportedImageFormats">
-        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF) with safe names (only Alpha-Numeric characters, only 1 dot, name and extension not empty) are accepted.</value>
+        <value xml:lang="en">For security reason only valid files of supported image formats (GIF, JPEG, PNG, TIFF) with safe names (only Alpha-Numeric characters, hyphen, underscore and spaces, only 1 dot, name and extension not empty) are accepted.</value>
         <value xml:lang="fr">Pour des raisons de sécurité, seuls les fichiers valides des formats d'image pris en charge (GIF, JPEG, PNG, TIFF) avec des noms sûrs (uniquement des caractères alphanumériques, 1 seul point, nom et extension non vides) sont acceptés.</value>
     </property>
     <property key="SupportedTextFileFormats">
-        <value xml:lang="en">For security reason only text files with safe names (only Alpha-Numeric characters, only 1 dot, name and extension not empty) and contents are accepted.</value>
+        <value xml:lang="en">For security reason only text files with safe names (only Alpha-Numeric characters, hyphen, underscore and spaces, only 1 dot, name and extension not empty) and contents are accepted.</value>
         <value xml:lang="fr">Pour des raisons de sécurité, seuls les fichiers texte dont les contenus et les noms sont sûrs (uniquement des caractères alphanumériques, 1 seul point, nom et extension non vides) sont acceptés</value>
     </property>
     <property key="UserLogin">
diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 9d13ff8..deecdbe 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -105,27 +105,37 @@ public class SecuredUpload {
             return true;
         }
 
+        String imageServerUrl = EntityUtilProperties.getPropertyValue("catalog", "image.management.url", delegator);
         Path p = Paths.get(fileToCheck);
         String file = p.getFileName().toString();
+        boolean wrongFile = true;
         if (org.apache.commons.lang3.SystemUtils.IS_OS_WINDOWS) {
             if (fileToCheck.length() > 259) {
                 Debug.logError("Uploaded file name too long", MODULE);
                 return false;
-            } else if (!file.matches("[a-zA-Z0-9]{1,249}.[a-zA-Z0-9]{1,10}")) {
-                Debug.logError("Uploaded file "
-                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension."
-                        + "The file name and extension should not be empty at all",
-                        MODULE);
-                return false;
+            } else if (p.toString().contains(imageServerUrl.replaceAll("/", "\\\\"))) {
+                if (file.matches("[a-zA-Z0-9-_ ()]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) { // "(" and ")" for duplicates files
+                    wrongFile = false;
+                } else if (!file.matches("[a-zA-Z0-9-_ ]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) {
+                    wrongFile = false;
+                }
             }
         } else {
             if (fileToCheck.length() > 4096) {
                 Debug.logError("Uploaded file name too long", MODULE);
                 return false;
-            } else if (!file.matches("[a-zA-Z0-9]{1,4086}.[a-zA-Z0-9]{1,10}")) {
+            } else if (p.toString().contains(imageServerUrl)) {
+                if (file.matches("[a-zA-Z0-9-_ ()]{1,4086}.[a-zA-Z0-9-_ ]{1,10}")) { // "(" and ")" for duplicates files
+                    wrongFile = false;
+                } else if (!file.matches("[a-zA-Z0-9-_ ]{1,4086}.[a-zA-Z0-9-_ ]{1,10}")) {
+                    wrongFile = false;
+                }
+            }
+            if (wrongFile) {
                 Debug.logError("Uploaded file "
-                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension."
-                        + "Tthe file name and extension should not be empty at all",
+                        + " should contain only Alpha-Numeric characters, hyphen, underscore and spaces,"
+                        + " only 1 dot as an input for the file name and the extension."
+                        + "The file name and extension should not be empty at all",
                         MODULE);
                 return false;
             }