From 3ff64f365c73f9fc8eb92bb2a08ddacfab8acea5 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Fri, 23 Aug 2019 15:24:41 -0300
Subject: [PATCH] =?UTF-8?q?validar=20que=20estemos=20subiendo=20im=C3=A1ge?=
 =?UTF-8?q?nes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile                                |   1 +
 app/models/metadata_image.rb              |  14 ++++++++++++++
 test/controllers/posts_controller_test.rb |  16 ++++++++++++++++
 test/fixtures/files/_logo.png             |   1 +
 test/fixtures/files/logo.png              | Bin 0 -> 2001 bytes
 5 files changed, 32 insertions(+)
 create mode 100644 test/fixtures/files/_logo.png
 create mode 100644 test/fixtures/files/logo.png

diff --git a/Dockerfile b/Dockerfile
index 4620f54d..e8f69093 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -72,6 +72,7 @@ RUN apk add --no-cache yarn
 RUN apk add --no-cache libgit2
 # Instalar foreman para poder correr los servicios
 RUN gem install --no-document --no-user-install foreman
+RUN apk add --no-cache file
 
 # Agregar el grupo del servidor web
 RUN addgroup -g 82 -S www-data
diff --git a/app/models/metadata_image.rb b/app/models/metadata_image.rb
index 763d4842..6f25ede3 100644
--- a/app/models/metadata_image.rb
+++ b/app/models/metadata_image.rb
@@ -16,6 +16,7 @@ class MetadataImage < MetadataTemplate
     super
 
     errors << I18n.t('metadata.image.path_required') if path_missing?
+    errors << I18n.t('metadata.image.not_an_image') unless image?
 
     errors.compact!
     errors.empty?
@@ -31,6 +32,19 @@ class MetadataImage < MetadataTemplate
     value['path'].is_a?(String)
   end
 
+  # Determina si es una imagen antes de subirla
+  def image?
+    if value['path'].is_a? ActionDispatch::Http::UploadedFile
+      `file --mime-type "#{value['path'].tempfile.path}"`
+        .split(' ')
+        .last
+        .chomp
+        .starts_with? 'image/'
+    else
+      true
+    end
+  end
+
   # Determina si la ruta es opcional pero deja pasar si la ruta se
   # especifica
   def path_optional?
diff --git a/test/controllers/posts_controller_test.rb b/test/controllers/posts_controller_test.rb
index 254b9280..06fb85e9 100644
--- a/test/controllers/posts_controller_test.rb
+++ b/test/controllers/posts_controller_test.rb
@@ -117,4 +117,20 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
 
     assert_equal 'hola', @post.image.value['description']
   end
+
+  test 'no se pueden subir archivos cualquiera' do
+    patch site_post_url(@site, @post.id),
+          headers: @authorization,
+          params: {
+            post: {
+              image: {
+                path: fixture_file_upload('files/_logo.png', 'image/png'),
+                description: 'hola'
+              }
+            }
+          }
+
+    assert_equal 200, response.status
+    assert_match I18n.t('metadata.image.not_an_image'), response.body
+  end
 end
diff --git a/test/fixtures/files/_logo.png b/test/fixtures/files/_logo.png
new file mode 100644
index 00000000..aa93b250
--- /dev/null
+++ b/test/fixtures/files/_logo.png
@@ -0,0 +1 @@
+pwned
diff --git a/test/fixtures/files/logo.png b/test/fixtures/files/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..234d6d248ec5a652ce1b660f2a29448900bfe4de
GIT binary patch
literal 2001
zcmV;?2QK)DP)<h;3K|Lk000e1NJLTq005Ez001}$1^@s67W|<G000M=Nkl<ZcmeHP
z3v3i+5T43g6bT5%2UeoId@DgDnxcSO@c|MQHK~&L02KuUjTn$<z!!!nB!EQ=(nL|g
z2Sia3QDaO+h(<IJga``6lt<gU_PV=wz2BMMg6-b_@BX`cC)d0AlF5a#d;k11-_HO4
zGqVT4kfIKZ(g>LIoe~A}j!cbF5A~<vcfKu=6?taPLMD<q7aeM*i&36Ivi6gYVVe17
zPbLx*iNQo-Fp(HcBqkDriNs(cF_=h9BqkCQNelI0UQ`Rl!)Vy&Q07FznuNyepLY{w
zB4r0rXdHpY+^m`?8gx?~SVMw*cMVvV;{7w6g5%vC&>>T0-xq~wFTJ@&dpjip)&j-c
zSIVvzAWm=_BL=av=%H*WsP|1O`#P^B(VCAC-BF4aa&j0>)Ij4owb0ntDN4O?A~R78
zHHlJ!j*lXl%KVd*qMDSP8-o$atW`MUVo$q+=;$?19U-E)jbqo)!jAKd29X9sGI>ZU
zO-+>{0?Tl<Ue*NJ(>=}S<QkEcBbi7!LZlR#hM^3XNC`?&5F6vzpDBXLZnB|d$uVOA
zCir&^U`S;m<qDBHqKr{UiC_ELypXO?w11XO_T!+Fq)5g@$`K+FlF4<7CGH<2)7d_w
z(fg_Zg7)j;V4diW4yjj!uLk`52<1}=Gh?ZZw|Nf}DTjz8L??UWEt8HuNHmbPFA9H6
zmpHfaTAe)*I&C(7!9M(ZMHI|C>p=AI>-fSXlCcc+j5s9fa*%Oe8^OOn<;yTa+<@}9
zLV9WvsY2na>LVadNxPvI%<+l|{p>J&C$FP!TOtyH4B`~KBU0w%<+AJ1CPn`B&T<|}
zh*7wd?UITRo?DT_5bNWzN<FK3Vs2GTY9EmYGKgFwlHxlHJ|T(vEmY`tBm&}8=}q-u
zUE&gED-S}rWEK<YI1x#RewaUcODaN)SNka1TV+?2m(=57XvQ1&y6gkCWAbq*6RFJ+
zsR&6^j?3AaG-+yDs>&;&4lk<qZVk|Iy6c#<ne)hG)9LNyu+fQ$^gj|QkY1t(>TpPr
z=2_@XUd##L#lL8jM*hST+wDxGHbf+fKFQ=piLAk>)V{TU%vlP**HgVsYdk8#;SGB<
zkG(4ofH;wf)CPzo#0VtQ0;vdbteXR~m0fX;`xSG4)7O}(7x#=!dKqo=N6ev|$wbO=
zBI)ZiRh3V~NOit{0;dvnv}dZ(Ak$Vq`z9vRaUzlsWy;O~OkPr&hqf&WAHNf7Y&$9S
zo<?-4U?Sx_k*JtES&`{3jezx_N}pP=F3;4YM|<p@4Bf$)NXLmt|B)%Z>Ft0h-UDWp
zLZ44EszVe+FU%!<>CyqPn2FQ|h?GojlP+&d;~&cPiC>j@JwS9oV}7StNB8I%&?-~h
zza@Y^om_fl&SfG=$uyu<!&_Voe*uHQ8(^-lbyWJ%R~xdX2QqY+$^eH!bo06&9Xv`^
z!$D$n_M;0erz%~7q$Uc2NGURv9BX!)kQnzgZl+0=q*{eqJdFOjU;Rdb&S9be9wP_2
zoB;3gM`~4--q;_`$$3wtDbnRFk*ux)^EX?Msvunr&7cN1B*S%RuqRdRBADGQRvCbD
zP#Q#ZtLyF5?QudvUTF8}Wc;{V07PoubUy&GE4PBVqowQv<Dfm)TeQEA@;^~9CfN;4
z+geAO_|=LiFjJL6N0PMDG~yEV3DEf3i%fXU0K9gWI<i^!GLbyVG!Xj7rx$}c&ndrx
z@s+Q>GulU>(drZvqPp9_me*4QoT{^rPIS8C+70E6F6o4w^q!lu7mA3F4ww=-_SDFG
ziK{`J#6<EyX?z$|CwEI_P-1itqrL0V^0}VsEbcE%D&8n?AGcB?(TSOL<6Hb(i=W@S
zwWqd7Lp&PZ$@xzt9A~v+{2llJw+}EO>xziR3y~gWlHGn!T-4X1O34S;qd6pZU?O>-
zuQ33|S&Lw7x=aJ}wlI@g7{Y;#c>j$-#>M0NV3$rjzw!qqO*7-<JSWn~_;lEi_$EzO
zC)NV!zh#mJD$=HwupkaJo(MB1+%H|`wsF>sh(FP3GILJOUn1G9LJis47T6VkW0?=<
zMZ%trj)Ims{LVFgmsmO}QZx;dd@M8~!9;VGG#Zu1KllPf*9;obD5WRd#ep&W|5bS1
zd6|D&nlsfa?04r}yEJk9Mf7xK!`Asqq-~VvyT*7`wl{(v!Mk2vLBE4U1y(fb^Em0(
zsRfgc<jPl3G6+gqQqdKSIu><!DD^Wn)<pdG7}Vo}Y>yv>c!}MQ)k^3g%hVWDPNHA(
zkjQ=6niuulD;|()Kfm9=C}ecQB=6p)-=%q@`>kofVCY~zMs!&gyEm9~a1H1Q42BoV
za1*^5%paU}HIiMpA7l$L^f1|aOj_-aB@aNKhBMee3{OzKaxs>{j`ke2lt-{`$rfU0
z;T0^jQ}?4&mV^0um@ZOAK|!>G?M+*x%i8ipIWQPH_zUxXvJE!M_ElgGVhb@eAd0$x
zA#Gfn0p@JB4?_>vCvH~0Sv%Ak%m!j;!EOkY)$-P{br_mx7$PmqqP&)&A53Eu0_Mi&
jK~-W?np7q#vN7DhAAy!sSiN@?00000NkvXXu0mjfBwMrq

literal 0
HcmV?d00001