diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 399b804cc..f887a54e6 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -771,19 +771,24 @@ curl http://localhost/api/v1/users/avatar -v -u #{login}:#{password} -H "Content begin file_full = StaticAssets.data_url_attributes(params[:avatar_full]) rescue - render json: { error: __('Full-size image is invalid') }, status: :unprocessable_entity + render json: { error: __('The full-size image is invalid.') }, status: :unprocessable_entity return end if ActiveStorage::Variant::WEB_IMAGE_CONTENT_TYPES.exclude?(file_full[:mime_type]) - render json: { error: __('MIME type is invalid') }, status: :unprocessable_entity + render json: { error: __('The MIME type of the full-size image is invalid.') }, status: :unprocessable_entity return end begin file_resize = StaticAssets.data_url_attributes(params[:avatar_resize]) rescue - render json: { error: __('Resized image is invalid') }, status: :unprocessable_entity + render json: { error: __('The resized image is invalid.') }, status: :unprocessable_entity + return + end + + if ActiveStorage::Variant::WEB_IMAGE_CONTENT_TYPES.exclude?(file_resize[:mime_type]) + render json: { error: __('The MIME type of the resized image is invalid.') }, status: :unprocessable_entity return end diff --git a/i18n/zammad.pot b/i18n/zammad.pot index 95123c4d0..8f46ac03c 100644 --- a/i18n/zammad.pot +++ b/i18n/zammad.pot @@ -4149,10 +4149,6 @@ msgstr "" msgid "Full Name" msgstr "" -#: app/controllers/users_controller.rb -msgid "Full-size image is invalid" -msgstr "" - #: db/seeds/settings.rb msgid "Fully Qualified Domain Name" msgstr "" @@ -5546,10 +5542,6 @@ msgstr "" msgid "Lost network connection!" msgstr "" -#: app/controllers/users_controller.rb -msgid "MIME type is invalid" -msgstr "" - #: app/assets/javascripts/app/controllers/macro.coffee msgid "Macro" msgstr "" @@ -7596,10 +7588,6 @@ msgstr "" msgid "Reseting changes…" msgstr "" -#: app/controllers/users_controller.rb -msgid "Resized image is invalid" -msgstr "" - #: app/assets/javascripts/app/views/widget/http_log_show.jst.eco msgid "Response" msgstr "" @@ -8785,6 +8773,14 @@ msgstr "" msgid "Thanks for joining. Email sent to \"%s\"." msgstr "" +#: app/controllers/users_controller.rb +msgid "The MIME type of the full-size image is invalid." +msgstr "" + +#: app/controllers/users_controller.rb +msgid "The MIME type of the resized image is invalid." +msgstr "" + #: app/assets/javascripts/app/views/getting_started/base.jst.eco msgid "The URL to this installation of Zammad." msgstr "" @@ -8845,6 +8841,10 @@ msgstr "" msgid "The format of the subject." msgstr "" +#: app/controllers/users_controller.rb +msgid "The full-size image is invalid." +msgstr "" + #: db/seeds/settings.rb msgid "The identifier for a ticket, e.g. Ticket#, Call#, MyTicket#. The default is Ticket#." msgstr "" @@ -8873,6 +8873,10 @@ msgstr "" msgid "The page you were looking for does not exist." msgstr "" +#: app/controllers/users_controller.rb +msgid "The resized image is invalid." +msgstr "" + #: app/assets/javascripts/app/views/generic/object_import/import_try.jst.eco msgid "The test run was successful." msgstr "" diff --git a/spec/requests/user_spec.rb b/spec/requests/user_spec.rb index f87f4668c..ab107b054 100644 --- a/spec/requests/user_spec.rb +++ b/spec/requests/user_spec.rb @@ -1505,12 +1505,12 @@ RSpec.describe 'User', type: :request do it 'returns verbose error when full image is missing' do make_request(avatar_full: '') - expect(json_response).to include('error' => match(%r{Full}).and(match(%r{is invalid}))) + expect(json_response).to include('error' => match(%r{full}).and(match(%r{is invalid}))) end it 'returns verbose error when resized image is missing' do make_request(avatar_full: base64) - expect(json_response).to include('error' => match(%r{Resized}).and(match(%r{is invalid}))) + expect(json_response).to include('error' => match(%r{resized}).and(match(%r{is invalid}))) end it 'successfully changes avatar' do @@ -1523,7 +1523,16 @@ RSpec.describe 'User', type: :request do it 'returns verbose error for a not allowed mime-type' do make_request(avatar_full: base64) - expect(json_response).to include('error' => 'MIME type is invalid') + expect(json_response).to include('error' => 'The MIME type of the full-size image is invalid.') + end + end + + context 'with a not allowed resized image mime-type' do + let(:resized_base64) { 'data:image/svg+xml;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==' } + + it 'returns verbose error for a not allowed mime-type' do + make_request(avatar_full: base64, avatar_resize: resized_base64) + expect(json_response).to include('error' => 'The MIME type of the resized image is invalid.') end end end