Set minimal permissions to temp files (#148899)

Thomas Bruederli

2013-04-10 2741d8ecedb156773328750be0d09ecc89afa4bd

 program/lib/Roundcube/rcube_image.php

@@ -2,8 +2,6 @@

/*
 +-----------------------------------------------------------------------+
 | program/include/rcube_image.php                                       |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2012, The Roundcube Dev Team                       |
 | Copyright (C) 2011-2012, Kolab Systems AG                             |
@@ -14,7 +12,6 @@
 |                                                                       |
 | PURPOSE:                                                              |
 |   Image resizer and converter                                         |
 |                                                                       |
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli <roundcube@gmail.com>                        |
 | Author: Aleksander Machniak <alec@alec.pl>                            |
@@ -80,7 +77,8 @@
    }

    /**
     * Resize image to a given size
     * Resize image to a given size. Use only to shrink an image.
     * If an image is smaller than specified size it will be not resized.
     *
     * @param int    $size      Max width/height size
     * @param string $filename  Output filename
@@ -126,24 +124,39 @@
            }

            if ($result === '') {
                @chmod($filename, 0600);
                return $type;
            }
        }

        // use GD extension
        $gd_types = array(IMAGETYPE_JPEG, IMAGETYPE_GIF, IMAGETYPE_PNG);
        if ($props['gd_type'] && in_array($props['gd_type'], $gd_types)) {
            if ($props['gd_type'] == IMAGETYPE_JPEG) {
        if ($props['gd_type']) {
            if ($props['gd_type'] == IMAGETYPE_JPEG && function_exists('imagecreatefromjpeg')) {
                $image = imagecreatefromjpeg($this->image_file);
                $type  = 'jpg';
            }
            elseif($props['gd_type'] == IMAGETYPE_GIF) {
            else if($props['gd_type'] == IMAGETYPE_GIF && function_exists('imagecreatefromgif')) {
                $image = imagecreatefromgif($this->image_file);
                $type  = 'gid';
            }
            elseif($props['gd_type'] == IMAGETYPE_PNG) {
            else if($props['gd_type'] == IMAGETYPE_PNG && function_exists('imagecreatefrompng')) {
                $image = imagecreatefrompng($this->image_file);
                $type  = 'png';
            }
            else {
                // @TODO: print error to the log?
                return false;
            }

            $scale  = $size / max($props['width'], $props['height']);
            $scale = $size / max($props['width'], $props['height']);

            // Imagemagick resize is implemented in shrinking mode (see -resize argument above)
            // we do the same here, if an image is smaller than specified size
            // we do nothing but copy original file to destination file
            if ($scale > 1) {
                return $this->image_file == $filename || copy($this->image_file, $filename) ? $type : false;
            }

            $width  = $props['width']  * $scale;
            $height = $props['height'] * $scale;

@@ -162,18 +175,16 @@

            if ($props['gd_type'] == IMAGETYPE_JPEG) {
                $result = imagejpeg($image, $filename, 75);
                $type = 'jpg';
            }
            elseif($props['gd_type'] == IMAGETYPE_GIF) {
                $result = imagegif($image, $filename);
                $type = 'gid';
            }
            elseif($props['gd_type'] == IMAGETYPE_PNG) {
                $result = imagepng($image, $filename, 6, PNG_ALL_FILTERS);
                $type = 'png';
            }

            if ($result) {
                @chmod($filename, 0600);
                return $type;
            }
        }
@@ -214,23 +225,27 @@
            $result = rcube::exec($convert . ' 2>&1 -colorspace RGB -quality 75 {in} {type}:{out}', $p);

            if ($result === '') {
                @chmod($filename, 0600);
                return true;
            }
        }

        // use GD extension (TIFF isn't supported)
        $props    = $this->props();
        $gd_types = array(IMAGETYPE_JPEG, IMAGETYPE_GIF, IMAGETYPE_PNG);
        $props = $this->props();

        if ($props['gd_type'] && in_array($props['gd_type'], $gd_types)) {
            if ($props['gd_type'] == IMAGETYPE_JPEG) {
        if ($props['gd_type']) {
            if ($props['gd_type'] == IMAGETYPE_JPEG && function_exists('imagecreatefromjpeg')) {
                $image = imagecreatefromjpeg($this->image_file);
            }
            else if ($props['gd_type'] == IMAGETYPE_GIF) {
            else if ($props['gd_type'] == IMAGETYPE_GIF && function_exists('imagecreatefromgif')) {
                $image = imagecreatefromgif($this->image_file);
            }
            else if ($props['gd_type'] == IMAGETYPE_PNG) {
            else if ($props['gd_type'] == IMAGETYPE_PNG && function_exists('imagecreatefrompng')) {
                $image = imagecreatefrompng($this->image_file);
            }
            else {
                // @TODO: print error to the log?
                return false;
            }

            if ($type == self::TYPE_JPG) {
@@ -242,6 +257,11 @@
            else if ($type == self::TYPE_PNG) {
                $result = imagepng($image, $filename, 6, PNG_ALL_FILTERS);
            }

            if ($result) {
                @chmod($filename, 0600);
                return true;
            }
        }

        // @TODO: print error to the log?