From ad74a829df955c6517a0e12e2df1122629888fed Mon Sep 17 00:00:00 2001 From: Pierre Paridans Date: Wed, 23 Dec 2020 11:50:59 +0000 Subject: [PATCH] [FIX] web: prevent crash on image resize/crop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When attempting to resize or crop an attachment through the '/web/image' route, if the attachment isn't actually an image (even if the record's mimetype says so) or doesn't match one of the format supported by PIL (Python Imaging Library) - like Apple's HEIF - the request crashes with a "500 Internal Error". Although it makes sense to return a response with an HTTP error code, a more sensible approach would be to return a "404 Not Found" response instead. The point by handling the Exception thrown by PIL and returning a 404 status code is to more closely match the semantic of this HTTP status code. Getting a resized version of a non-image doesn't really make sense as this resource doesn't exist at all ; hence the "404 Not Found" response. On the other hand returning a "500 Internal Error" would denote that a legitimate request failed on the server side, which is not the case here. Note: this difference of semantic, even if only visible in a regular browser, has its importance in the mobile apps because we use it to given a meaningful feedback to the user in case if failed HTTP requests. Note: the mimetype detection could be improved to ease the handling of this kind of errors but would require too much changes to be done in stable branch. Steps to reproduce in Discuss: - rename an HEIF file with a ".jpeg" extension - upload it in a chat window => the thumbnail in the chat window throws an HTTP error 500 opw-2417172 closes odoo/odoo#63772 X-original-commit: 873bc2aa5a8fcfc0664fc5ca70f789911873d583 Related: odoo/enterprise#15462 Signed-off-by: Pierre Paridans Signed-off-by: Adrien Dieudonné (adr) --- addons/web/controllers/main.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index ccce09630d1..c651ac9bce7 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -1531,7 +1531,10 @@ class Binary(http.Controller): if not (width or height): width, height = odoo.tools.image_guess_size_from_field_name(field) - image_base64 = image_process(image_base64, size=(int(width), int(height)), crop=crop, quality=int(quality)) + try: + image_base64 = image_process(image_base64, size=(int(width), int(height)), crop=crop, quality=int(quality)) + except Exception: + return request.not_found() content = base64.b64decode(image_base64) headers = http.set_safe_image_headers(headers, content)