Project

General

Profile

Download (2 KB)

Defect #44620 ยป 0001-Prevent-serving-partially-written-thumbnails.patch

Go MAEDA, 2026-10-15 10:10

View differences:

lib/redmine/thumbnail.rb
44 44 
        directory = File.dirname(target)
45 45 
        FileUtils.mkdir_p directory
46 
        # Write to a temporary file first so that concurrent requests never
47 
        # serve a partially written thumbnail
48 
        output = File.join(directory, "#{Redmine::Utils.random_hex(8)}.#{File.basename(target)}")
46 49 
        size_option = "#{size}x#{size}>"
47 50 
        if mime_type == 'application/pdf'
48 51 
          return nil unless gs_available?
49 52 
          return nil unless valid_pdf_magic?(source)
50 
          cmd = "#{shell_quote CONVERT_BIN} #{shell_quote "#{source}[0]"} -thumbnail #{shell_quote size_option} #{shell_quote "png:#{target}"}"
53 
          cmd = "#{shell_quote CONVERT_BIN} #{shell_quote "#{source}[0]"} -thumbnail #{shell_quote size_option} #{shell_quote "png:#{output}"}"
51 54 
        else
52 
          cmd = "#{shell_quote CONVERT_BIN} #{shell_quote source} -auto-orient -thumbnail #{shell_quote size_option} #{shell_quote target}"
55 
          cmd = "#{shell_quote CONVERT_BIN} #{shell_quote source} -auto-orient -thumbnail #{shell_quote size_option} #{shell_quote output}"
53 56 
        end
54 57 
        pid = nil
......
70 73 
              return nil
71 74 
            end
72 75 
          end
76 
          File.rename(output, target)
73 77 
        rescue Timeout::Error
74 78 
          if pid
75 79 
            begin
......
82 86 
          end
83 87 
          logger.error("Creating thumbnail timed out:\nCommand: #{cmd}")
84 88 
          return nil
89 
        ensure
90 
          FileUtils.rm_f(output)
85 91 
        end
86 92 
      end
87 93 
      target
    (1-1/1)