Ticket #5246 - Allow to upload SVG files as images.

inc/classes/BxDolStorage.php

@@ -187,6 +187,7 @@ define('BX_DOL_STORAGE_QUEUED_DELETIONS_PER_RUN', 200); ///< max number of file
  * you control this period using 'token_life' field in 'sys_objects_storage' table.
  *
  */
+
 abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
 {
     protected $_aObject; ///< object properties
@@ -195,6 +196,7 @@ abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
     protected $_iErrorCode; ///< last error code
     protected $_oDb; ///< database relates function are in this object
     protected $_aMimeTypesViewable = ['audio/', 'image/', 'video/']; ///< file types (by mime type) to allow view file in browser instead of downloading
+    protected $_bSanitizeSvg = true; ///< enable/disable SVG sanitization
     
     /**
      * constructor
@@ -463,6 +465,26 @@ abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
             return false;
         }
 
+        // perform SVG sanitization
+
+        if($this->isMimeTypeSvg($sMimeType) && $this->isSanitizeSvg()) {
+            $oSanitizer = new enshrined\svgSanitize\Sanitizer();
+
+            $sSvgOrig = @file_get_contents($sTmpFile);
+            if($sSvgOrig === false) {
+                $this->setErrorCode(BX_DOL_STORAGE_INVALID_FILE);
+                return false;
+            }
+
+            $sSvgClean = $oSanitizer->sanitize($sSvgOrig);
+            if($sSvgClean === false) {
+                $this->setErrorCode(BX_DOL_STORAGE_INVALID_FILE);
+                return false;
+            }
+
+            file_put_contents($sTmpFile, $sSvgClean);
+        }
+
         // process additional custom fields, like video duration and video dimension
 
         $aAdditionalFields = array();
@@ -1103,7 +1125,22 @@ abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
             $sIcon = BX_DOL_STORAGE_DEFAULT_ICON_FONT;
         return $sIcon;
     }
-    
+
+    public function setSanitizeSvg($bSanitize)
+    {
+        $this->_bSanitizeSvg = $bSanitize;
+    }
+
+    public function isSanitizeSvg()
+    {
+        return $this->_bSanitizeSvg && !isAdmin();
+    }
+
+    public function isMimeTypeSvg($sMimeType)
+    {
+        return strncmp('image/svg', $sMimeType, 9) === 0;
+    }
+
     // ------------ internal functions - events
 
     protected function onBeforeFileAdd ($aFileInfo)

inc/classes/BxDolTranscoderImage.php

@@ -111,7 +111,7 @@ class BxDolTranscoderImage extends BxDolTranscoder implements iBxDolFactoryObjec
 
     public function isMimeTypeSvg($sMimeType)
     {
-        return strncmp('image/svg', $sMimeType, 9) === 0;
+        return $this->_oStorage->isMimeTypeSvg($sMimeType);
     }
 
     /**

install/sql/system.sql

@@ -445,7 +445,7 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_css_tailwind_default', '_adm_stg_cpt_option_sys_css_tailwind_default', 'tailwind.min.css', 'select', 'a:3:{s:6:"module";s:6:"system";s:6:"method";s:27:"get_options_taiwind_default";s:5:"class";s:13:"TemplServices";}', '', '', '', 181),
 (@iCategoryId, 'sys_iconset_default', '_adm_stg_cpt_option_sys_iconset_default', 'sys_fontawesome', 'select', 'a:3:{s:6:"module";s:6:"system";s:6:"method";s:27:"get_options_iconset_default";s:5:"class";s:13:"TemplServices";}', '', '', '', 185),
 
-(@iCategoryId, 'sys_files_ext_images', '_adm_stg_cpt_option_sys_files_ext_images', 'jpg,jpeg,jpe,gif,png,webp', 'digit', '', '', '', '', 200),
+(@iCategoryId, 'sys_files_ext_images', '_adm_stg_cpt_option_sys_files_ext_images', 'jpg,jpeg,jpe,gif,png,webp,svg', 'digit', '', '', '', '', 200),
 (@iCategoryId, 'sys_files_ext_video', '_adm_stg_cpt_option_sys_files_ext_video', 'avi,flv,mpg,mpeg,wmv,mp4,m4v,mov,qt,divx,xvid,3gp,3g2,webm,mkv,ogv,ogg,rm,rmvb,asf,drc,ts', 'digit', '', '', '', '', 210),
 (@iCategoryId, 'sys_files_ext_audio', '_adm_stg_cpt_option_sys_files_ext_audio', 'mp3,m4a,m4b,wma,wav,3gp', 'digit', '', '', '', '', 220),
 (@iCategoryId, 'sys_files_ext_imagevideo', '_adm_stg_cpt_option_sys_files_ext_imagevideo', 'jpg,jpeg,jpe,gif,png,svg,webp,avi,flv,mpg,mpeg,wmv,mp4,m4v,mov,qt,divx,xvid,3gp,3g2,webm,mkv,ogv,ogg,rm,rmvb,asf,drc,ts', 'digit', '', '', '', '', 230),
@@ -2657,11 +2657,11 @@ CREATE TABLE IF NOT EXISTS `sys_objects_storage` (
 );
 
 INSERT INTO `sys_objects_storage` (`object`, `engine`, `params`, `token_life`, `cache_control`, `levels`, `table_files`, `ext_mode`, `ext_allow`, `ext_deny`, `quota_size`, `current_size`, `quota_number`, `current_number`, `max_file_size`, `ts`) VALUES
-('sys_images', 'Local', '', 360, 2592000, 0, 'sys_images', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
-('sys_images_custom', 'Local', '', 360, 2592000, 0, 'sys_images_custom', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
-('sys_images_resized', 'Local', '', 360, 2592000, 0, 'sys_images_resized', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
-('sys_cmts_images', 'Local', '', 360, 2592000, 3, 'sys_cmts_images', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
-('sys_cmts_images_preview', 'Local', '', 360, 2592000, 3, 'sys_cmts_images_preview', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
+('sys_images', 'Local', '', 360, 2592000, 0, 'sys_images', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
+('sys_images_custom', 'Local', '', 360, 2592000, 0, 'sys_images_custom', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
+('sys_images_resized', 'Local', '', 360, 2592000, 0, 'sys_images_resized', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
+('sys_cmts_images', 'Local', '', 360, 2592000, 3, 'sys_cmts_images', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
+('sys_cmts_images_preview', 'Local', '', 360, 2592000, 3, 'sys_cmts_images_preview', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
 ('sys_transcoder_queue_files', 'Local', '', 3600, 2592000, 0, 'sys_transcoder_queue_files', 'allow-deny', 'avi,flv,mpg,mpeg,wmv,mp4,m4v,mov,divx,xvid,3gp,webm,jpg', '', 0, 0, 0, 0, 0, 0),
 ('sys_files', 'Local', '', 360, 2592000, 3, 'sys_files', 'deny-allow', '', '{dangerous}', 0, 0, 0, 0, 0, 0),
 ('sys_images_editor', 'Local', '', 360, 2592000, 3, 'sys_images_editor', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),

modules/boonex/timeline/install/sql/install.sql

@@ -515,11 +515,11 @@ INSERT INTO `sys_objects_uploader` (`object`, `active`, `override_class_name`, `
 ('bx_timeline_html5_file', 1, 'BxTimelineUploaderHTML5Attach', 'modules/boonex/timeline/classes/BxTimelineUploaderHTML5Attach.php');
 
 INSERT INTO `sys_objects_storage` (`object`, `engine`, `params`, `token_life`, `cache_control`, `levels`, `table_files`, `ext_mode`, `ext_allow`, `ext_deny`, `quota_size`, `current_size`, `quota_number`, `current_number`, `max_file_size`, `ts`) VALUES
-('bx_timeline_photos', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_photos', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
-('bx_timeline_photos_processed', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_photos_processed', 'allow-deny', '{image},svg', '', 0, 0, 0, 0, 0, 0),
+('bx_timeline_photos', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_photos', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
+('bx_timeline_photos_processed', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_photos_processed', 'allow-deny', '{image}', '', 0, 0, 0, 0, 0, 0),
 
-('bx_timeline_videos', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_videos', 'allow-deny', '{imagevideo},svg', '', 0, 0, 0, 0, 0, 0),
-('bx_timeline_videos_processed', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_videos_processed', 'allow-deny', '{imagevideo},svg', '', 0, 0, 0, 0, 0, 0),
+('bx_timeline_videos', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_videos', 'allow-deny', '{imagevideo}', '', 0, 0, 0, 0, 0, 0),
+('bx_timeline_videos_processed', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_videos_processed', 'allow-deny', '{imagevideo}', '', 0, 0, 0, 0, 0, 0),
 
 ('bx_timeline_files', @sStorageEngine, '', 360, 2592000, 3, 'bx_timeline_files', 'deny-allow', '', 'jpg,jpeg,jpe,gif,png,{dangerous}', 0, 0, 0, 0, 0, 0);