This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | /* global $, DOMPurify, Gallery */ |
||
2 | /** |
||
3 | * A thumbnail is the actual image attached to the GalleryImage object |
||
4 | * |
||
5 | * @param {number} fileId |
||
6 | * @param {boolean} square |
||
7 | * @constructor |
||
8 | */ |
||
9 | function Thumbnail (fileId, square) { |
||
10 | this.square = square; |
||
11 | this.fileId = fileId; |
||
12 | this.image = null; |
||
13 | this.loadingDeferred = new $.Deferred(); |
||
14 | this.height = 200; |
||
15 | this.width = 400; |
||
16 | this.ratio = null; |
||
17 | this.valid = true; |
||
18 | this.status = 200; |
||
19 | } |
||
20 | |||
21 | (function ($, OC, Gallery) { |
||
22 | "use strict"; |
||
23 | var Thumbnails = { |
||
24 | map: {}, |
||
25 | squareMap: {}, |
||
26 | |||
27 | /** |
||
28 | * Retrieves the thumbnail linked to the given fileID |
||
29 | * |
||
30 | * @param {number} fileId |
||
31 | * @param {boolean} square |
||
32 | * |
||
33 | * @returns {Thumbnail} |
||
34 | */ |
||
35 | get: function (fileId, square) { |
||
36 | var map = {}; |
||
37 | if (square === true) { |
||
38 | map = Thumbnails.squareMap; |
||
39 | square = true; |
||
40 | } else { |
||
41 | map = Thumbnails.map; |
||
42 | square = false; |
||
43 | } |
||
44 | if (!map[fileId]) { |
||
45 | map[fileId] = new Thumbnail(fileId, square); |
||
46 | } |
||
47 | |||
48 | return map[fileId]; |
||
49 | }, |
||
50 | |||
51 | /** |
||
52 | * Returns an icon of a specific type |
||
53 | * |
||
54 | * -1 is for a folder |
||
55 | * -404 is for a broken file icon |
||
56 | * -500 is for a media type icon |
||
57 | * |
||
58 | * @param {number} type |
||
59 | * |
||
60 | * @returns {Thumbnail} |
||
61 | */ |
||
62 | getStandardIcon: function (type) { |
||
63 | if (!Thumbnails.squareMap[type]) { |
||
64 | var icon = ''; |
||
65 | // true means square |
||
66 | var thumb = new Thumbnail(type, true); |
||
67 | thumb.image = new Image(); |
||
0 ignored issues
–
show
|
|||
68 | thumb.image.onload = function () { |
||
69 | thumb.loadingDeferred.resolve(thumb.image); |
||
70 | }; |
||
71 | |||
72 | if (type === -1) { |
||
73 | icon = 'filetypes/folder'; |
||
74 | } |
||
75 | thumb.image.src = OC.imagePath('core', icon); |
||
76 | |||
77 | Thumbnails.squareMap[type] = thumb; |
||
78 | } |
||
79 | |||
80 | return Thumbnails.squareMap[type]; |
||
81 | }, |
||
82 | |||
83 | /** |
||
84 | * Loads thumbnails in batch, using EventSource |
||
85 | * |
||
86 | * @param {Array} ids |
||
87 | * @param {boolean} square |
||
88 | * |
||
89 | * @returns {{}} |
||
90 | */ |
||
91 | loadBatch: function (ids, square) { |
||
92 | var map = (square) ? Thumbnails.squareMap : Thumbnails.map; |
||
93 | // Prevents re-loading thumbnails when resizing the window |
||
94 | ids = ids.filter(function (id) { |
||
95 | return !map[id]; |
||
96 | }); |
||
97 | var batch = {}; |
||
98 | var i, idsLength = ids.length; |
||
99 | if (idsLength) { |
||
100 | for (i = 0; i < idsLength; i++) { |
||
101 | var thumb = new Thumbnail(ids[i], square); |
||
102 | thumb.image = new Image(); |
||
0 ignored issues
–
show
The variable
Image seems to be never declared. If this is a global, consider adding a /** global: Image */ comment.
This checks looks for references to variables that have not been declared. This is most likey a typographical error or a variable has been renamed. To learn more about declaring variables in Javascript, see the MDN. ![]() |
|||
103 | map[ids[i]] = batch[ids[i]] = thumb; |
||
104 | |||
105 | } |
||
106 | var params = { |
||
107 | ids: ids.join(';'), |
||
108 | scale: window.devicePixelRatio, |
||
109 | square: (square) ? 1 : 0 |
||
110 | }; |
||
111 | var url = Gallery.utility.buildGalleryUrl('thumbnails', '', params); |
||
112 | |||
113 | var eventSource = new Gallery.EventSource(url); |
||
114 | eventSource.listen('preview', |
||
115 | function (/**{path, status, mimetype, preview}*/ preview) { |
||
116 | var id = preview.fileid; |
||
117 | var thumb = batch[id]; |
||
118 | thumb.status = preview.status; |
||
119 | if (thumb.status === 404) { |
||
120 | thumb.valid = false; |
||
121 | thumb.loadingDeferred.resolve(null); |
||
122 | } else { |
||
123 | thumb.image.onload = function () { |
||
124 | // Fix for SVG files which can come in all sizes |
||
125 | if (square) { |
||
126 | thumb.image.width = 200; |
||
127 | thumb.image.height = 200; |
||
128 | } |
||
129 | thumb.ratio = thumb.image.width / thumb.image.height; |
||
130 | thumb.image.originalWidth = 200 * thumb.ratio; |
||
131 | thumb.loadingDeferred.resolve(thumb.image); |
||
132 | }; |
||
133 | thumb.image.onerror = function () { |
||
134 | thumb.valid = false; |
||
135 | var icon = Thumbnails._getMimeIcon(preview.mimetype); |
||
136 | setTimeout(function () { |
||
137 | thumb.image.src = icon; |
||
138 | }, 0); |
||
139 | }; |
||
140 | |||
141 | if (thumb.status === 200) { |
||
142 | var imageData = preview.preview; |
||
143 | if (preview.mimetype === 'image/svg+xml') { |
||
144 | imageData = Thumbnails._purifySvg(imageData); |
||
145 | } |
||
146 | thumb.image.src = |
||
147 | 'data:' + preview.mimetype + ';base64,' + imageData; |
||
148 | } else { |
||
149 | thumb.valid = false; |
||
150 | thumb.image.src = Thumbnails._getMimeIcon(preview.mimetype); |
||
151 | } |
||
152 | } |
||
153 | }); |
||
154 | } |
||
155 | |||
156 | return batch; |
||
157 | }, |
||
158 | |||
159 | /** |
||
160 | * Returns the link to the media type icon |
||
161 | * |
||
162 | * Modern browsers get an SVG, older ones a PNG |
||
163 | * |
||
164 | * @param mimeType |
||
165 | * |
||
166 | * @returns {*|string} |
||
167 | * @private |
||
168 | */ |
||
169 | _getMimeIcon: function (mimeType) { |
||
170 | var icon = OC.MimeType.getIconUrl(mimeType); |
||
171 | if (Gallery.ieVersion !== false) { |
||
172 | icon = icon.substr(0, icon.lastIndexOf(".")) + ".png"; |
||
173 | } |
||
174 | return icon; |
||
175 | }, |
||
176 | |||
177 | /** |
||
178 | * Sanitises SVGs |
||
179 | * |
||
180 | * We also fix a problem which arises when the XML contains comments |
||
181 | * |
||
182 | * @param imageData |
||
183 | * @returns {string|*} |
||
184 | * @private |
||
185 | */ |
||
186 | _purifySvg: function (imageData) { |
||
187 | var pureSvg = DOMPurify.sanitize(window.atob(imageData), {ADD_TAGS: ['filter']}); |
||
188 | // Remove XML comment garbage left in the purified data |
||
189 | var badTag = pureSvg.indexOf(']>'); |
||
190 | var fixedPureSvg = pureSvg.substring(badTag < 0 ? 0 : 5, pureSvg.length); |
||
191 | imageData = window.btoa(fixedPureSvg); |
||
192 | |||
193 | return imageData; |
||
194 | } |
||
195 | |||
196 | }; |
||
197 | |||
198 | window.Thumbnails = Thumbnails; |
||
199 | })(jQuery, OC, Gallery); |
||
200 |
This checks looks for references to variables that have not been declared. This is most likey a typographical error or a variable has been renamed.
To learn more about declaring variables in Javascript, see the MDN.