From 38ad8f35da93c19074e924323ad6ca2f1e7a89cd Mon Sep 17 00:00:00 2001 From: Mark Nelson Date: Thu, 31 Oct 2013 16:06:42 +0800 Subject: [PATCH] MDL-42566 mod_data: introduced check to ensure the picture supplied is valid --- mod/data/field/picture/field.class.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mod/data/field/picture/field.class.php b/mod/data/field/picture/field.class.php index ae02f3d0744..bf668392320 100644 --- a/mod/data/field/picture/field.class.php +++ b/mod/data/field/picture/field.class.php @@ -250,6 +250,13 @@ class data_field_picture extends data_field_base { $content->content = $draftfile->get_filename(); $file = $fs->create_file_from_storedfile($file_record, $draftfile); + + // If the file is not a valid image, redirect back to the upload form. + if ($file->get_imageinfo() === false) { + $url = new moodle_url('/mod/data/edit.php', array('d' => $this->field->dataid)); + redirect($url, get_string('invalidfiletype', 'error', $file->get_filename())); + } + $DB->update_record('data_content', $content); $this->update_thumbnail($content, $file);