Validate the avatar mime type against the extension list

see https://www.woltlab.com/community/thread/298731-avatar-upload-pr%C3%BCft-lediglich-dateiendnung-aber-nicht-das-format/

diff --git a/wcfsetup/install/files/lib/system/upload/AvatarUploadFileValidationStrategy.class.php b/wcfsetup/install/files/lib/system/upload/AvatarUploadFileValidationStrategy.class.php
index f28ca4c9b57791e02bd956eb5d5ccd00ea532792..ef44192da2c8e77261fca4a10525b2d0c35c5aa2 100644 (file)
--- a/wcfsetup/install/files/lib/system/upload/AvatarUploadFileValidationStrategy.class.php
+++ b/wcfsetup/install/files/lib/system/upload/AvatarUploadFileValidationStrategy.class.php
@@ -32,15 +32,36 @@ class AvatarUploadFileValidationStrategy extends DefaultUploadFileValidationStra
 
                 return false;
             } else {
-                // Reject WebP images regardless of any file extension restriction, they are
-                // neither supported in Safari nor in Internet Explorer 11. We can safely lift
-                // this restriction once Apple implements the support or if any sort of fall-
-                // back mechanism is implemented: https://github.com/WoltLab/WCF/issues/2838
+                switch ($imageData[2]) {
+                    case \IMAGETYPE_WEBP:
+                        // Reject WebP images regardless of any file extension restriction, they are
+                        // neither supported in Safari nor in Internet Explorer 11. We can safely lift
+                        // this restriction once Apple implements the support or if any sort of fall-
+                        // back mechanism is implemented: https://github.com/WoltLab/WCF/issues/2838
 
-                if ($imageData[2] === \IMAGETYPE_WEBP) {
-                    $uploadFile->setValidationErrorType('invalidExtension');
+                        $uploadFile->setValidationErrorType('invalidExtension');
 
-                    return false;
+                        return false;
+                    case \IMAGETYPE_PNG:
+                    case \IMAGETYPE_GIF:
+                    case \IMAGETYPE_JPEG:
+                        // Validate the mime type against the list of allowed extensions.
+                        //
+                        // We usually don't care about the extension, restricting allowed file extensions
+                        // primarily exists to prevent users from uploaded clickable '.exe'. The software
+                        // itself only ever uses the mime type.
+                        //
+                        // In the case of avatars, though, the administrator might want to disallow uploading
+                        // GIF files to prevent the most common case of animated avatar, thus we specifically
+                        // validate the mime type against the extension.
+                        $extension = \image_type_to_extension($imageData[2], false);
+                        if (!\in_array($extension, $this->fileExtensions)) {
+                            $uploadFile->setValidationErrorType('invalidExtension');
+
+                            return false;
+                        }
+
+                        break;
                 }
             }
         } catch (SystemException $e) {