fixed avatar eicar check (#5779)

* fixed avatar eicar check * fixed eslint minor issues
bigbluebutton · Apr 15, 2024 · 6ddd441 · 6ddd441
1 parent d6a2803
commit 6ddd441
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb
@@ -106,6 +106,12 @@ def update
           return render_error errors: Rails.configuration.custom_error_msgs[:unauthorized], status: :forbidden
         end
 
+        original_avatar = params['user']['original_avatar']
+        if ENV.fetch('CLAMAV_SCANNING', 'false') == 'true' && original_avatar.present? && !Clamby.safe?(original_avatar.tempfile.path)
+          user.errors.add(:avatar, 'MalwareDetected')
+          return render_error errors: user.errors.to_a
+        end
+
         if user.update(update_user_params)
           create_default_room(user)
           render_data  status: :ok

diff --git a/app/javascript/components/users/user/SetAvatar.jsx b/app/javascript/components/users/user/SetAvatar.jsx
@@ -72,7 +72,7 @@ export default function SetAvatar({ user }) {
   const editor = useRef(null);
   const handleSave = () => {
     if (editor) {
-      createAvatar.mutate(editor.current.getImageScaledToCanvas());
+      createAvatar.mutate({ original: avatar, resized: editor.current.getImageScaledToCanvas() });
       handleClose();
     }
   };

diff --git a/app/javascript/hooks/mutations/users/useCreateAvatar.jsx b/app/javascript/hooks/mutations/users/useCreateAvatar.jsx
@@ -23,13 +23,14 @@ export default function useCreateAvatar(currentUser) {
   const { t } = useTranslation();
   const queryClient = useQueryClient();
 
-  async function createAvatar(avatar) {
+  async function createAvatar({ original, resized }) {
     // TODO - samuel: how to validate if toBlob() will transform any file into a png by default
     const avatarBlob = await new Promise((resolve) => {
-      avatar.toBlob(resolve);
+      resized.toBlob(resolve);
     });
     const formData = new FormData();
     formData.append('user[avatar]', avatarBlob);
+    formData.append('user[original_avatar]', original);
     return axios.patch(`/users/${currentUser.id}.json`, formData, {
       headers: {
         'Content-Type': 'multipart/form-data',