From 727f3a4707598ed8ea6eee37f990e423fb3a3baa Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Wed, 7 Aug 2019 10:49:28 +0300
Subject: [PATCH] attachment entry point allow only image types

---
 application/Espo/EntryPoints/Attachment.php | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/application/Espo/EntryPoints/Attachment.php b/application/Espo/EntryPoints/Attachment.php
index 109c6cb210..370e7f0527 100644
--- a/application/Espo/EntryPoints/Attachment.php
+++ b/application/Espo/EntryPoints/Attachment.php
@@ -37,6 +37,13 @@ class Attachment extends \Espo\Core\EntryPoints\Base
 {
     public static $authRequired = true;
 
+    protected $allowedFileTypes = [
+        'image/jpeg',
+        'image/png',
+        'image/gif',
+        'image/webp',
+    ];
+
     public function run()
     {
         $id = $_GET['id'];
@@ -60,8 +67,14 @@ class Attachment extends \Espo\Core\EntryPoints\Base
             throw new NotFound();
         }
 
+        $fileType = $attachment->get('type');
+
+        if (!in_array($fileType, $this->allowedFileTypes)) {
+            throw new Forbidden("EntryPoint Attachment: Not allowed type {$fileType}.");
+        }
+
         if ($attachment->get('type')) {
-            header('Content-Type: ' . $attachment->get('type'));
+            header('Content-Type: ' . $fileType);
         }
 
         header('Pragma: public');
@@ -70,4 +83,3 @@ class Attachment extends \Espo\Core\EntryPoints\Base
         exit;
     }
 }
-