From 145814d29cadd761631b8724da329f1d09990a32 Mon Sep 17 00:00:00 2001 From: Krzysztof Kotlarek Date: Tue, 15 Sep 2020 09:22:57 +1000 Subject: [PATCH] FIX: spec for oversized images security fix Spec to cover solution presented here - https://github.com/discourse/discourse/commit/333ddd40118bc5324c797d93f369669f6fd8e480 --- spec/models/upload_spec.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/spec/models/upload_spec.rb b/spec/models/upload_spec.rb index 3415363b6b6..23d443069c5 100644 --- a/spec/models/upload_spec.rb +++ b/spec/models/upload_spec.rb @@ -78,6 +78,17 @@ describe Upload do expect(upload.thumbnail_width).to eq(nil) end + it 'returns error when image resolution is to big' do + begin + SiteSetting.max_image_megapixels = 10 + upload = UploadCreator.new(huge_image, "image.png").create_for(user_id) + expect(upload.id).to be_nil + expect(upload.errors.messages[:base].first).to eq("Sorry, the image you are trying to upload is too large (maximum dimension is 20-megapixels), please resize it and try again.") + ensure + SiteSetting.max_image_megapixels = 40 + end + end + it "extracts file extension" do created_upload = UploadCreator.new(image, image_filename).create_for(user_id) expect(created_upload.extension).to eq("png")