"Imaginary: disable document processing by default"

Signed-off-by: ernolf <[email protected]>

config/config.sample.php

@@ -1307,6 +1307,17 @@
  */
 'preview_imaginary_key' => 'secret',
 
+/**
+ * Due to security concerns, Imaginary does not process document files by default.
+ * The following mimetypes are always processed:
+ * bmp, x-bitmap, png, jpeg, gif, heic, heif, svg+xml, tiff and webp
+ * 
+ * Set to ``true``  to enable processing of documents of type pdf and illustrator.
+ * 
+ * Defaults to ``false``
+ */
+'imaginary_process_documents' => false,
+
 /**
  * Only register providers that have been explicitly enabled
  *

lib/private/Preview/Imaginary.php

@@ -40,7 +40,15 @@ public function getMimeType(): string {
 	}
 
 	public static function supportedMimeTypes(): string {
-		return '/(image\/(bmp|x-bitmap|png|jpeg|gif|heic|heif|svg\+xml|tiff|webp)|application\/(pdf|illustrator))/';
+		$config = \OC::$server->getConfig();
+		// Check if processing of documents is enabled
+		$processDocuments = $config->getSystemValueBool('imaginary_process_documents', false);
+
+		if ($processDocuments) {
+			return '/(image\/(bmp|x-bitmap|png|jpeg|gif|heic|heif|svg\+xml|tiff|webp)|application\/(pdf|illustrator))/';
+		} else {
+			return '/(image\/(bmp|x-bitmap|png|jpeg|gif|heic|heif|svg\+xml|tiff|webp))/';
+		}
 	}
 
 	public function getCroppedThumbnail(File $file, int $maxX, int $maxY, bool $crop): ?IImage {
@@ -81,8 +89,17 @@ public function getCroppedThumbnail(File $file, int $maxX, int $maxY, bool $crop
 				$mimeType = 'png';
 				break;
 			case 'image/svg+xml':
+				$convert = true;
+				// Converted files do not need to be autorotated
+				$autorotate = false;
+				$mimeType = 'png';
+				break;
 			case 'application/pdf':
 			case 'application/illustrator':
+				// Check if processing of documents is enabled
+				if (!$this->config->getSystemValueBool('imaginary_process_documents', false)) {
+					return null;
+				}
 				$convert = true;
 				// Converted files do not need to be autorotated
 				$autorotate = false;