diff options
| author | William Pitcock <nenolod@dereferenced.org> | 2018-10-29 16:39:00 +0000 |
|---|---|---|
| committer | William Pitcock <nenolod@dereferenced.org> | 2018-10-29 16:43:05 +0000 |
| commit | 181f3bb56a0bc0211ddd2e8f215d93973222b405 (patch) | |
| tree | 7dee6c3b07b5ad318a134ae782c3c035a67da6a5 | |
| parent | e12489e2fee6d757e432aadf2c49dbd10c70eef2 (diff) | |
| download | pleroma-181f3bb56a0bc0211ddd2e8f215d93973222b405.tar.gz | |
mastodon api: enforce upload limits for avatars and banners
| -rw-r--r-- | lib/pleroma/web/mastodon_api/mastodon_api_controller.ex | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex index bc7558cb8..e03027be7 100644 --- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex +++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex @@ -35,6 +35,14 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do def update_credentials(%{assigns: %{user: user}} = conn, params) do original_user = user + avatar_upload_limit = + Application.get_env(:pleroma, :instance) + |> Keyword.fetch(:avatar_upload_limit) + + banner_upload_limit = + Application.get_env(:pleroma, :instance) + |> Keyword.fetch(:banner_upload_limit) + params = if bio = params["note"] do Map.put(params, "bio", bio) @@ -52,7 +60,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do user = if avatar = params["avatar"] do with %Plug.Upload{} <- avatar, - {:ok, object} <- ActivityPub.upload(avatar), + {:ok, object} <- ActivityPub.upload(avatar, avatar_upload_limit), change = Ecto.Changeset.change(user, %{avatar: object.data}), {:ok, user} = User.update_and_set_cache(change) do user @@ -66,7 +74,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do user = if banner = params["header"] do with %Plug.Upload{} <- banner, - {:ok, object} <- ActivityPub.upload(banner), + {:ok, object} <- ActivityPub.upload(banner, banner_upload_limit), new_info <- Map.put(user.info, "banner", object.data), change <- User.info_changeset(user, %{info: new_info}), {:ok, user} <- User.update_and_set_cache(change) do |