Photo size validation

Question

I use the Fox Contact component on my website, and through that component users send me photos (as an attachment) I had to make a few modifications in the upload form itself and make filters for file name (only certain names are allowed). This filter works without any problems. I still have to do validation to check the size of the photo but I have no success. Even though the photo is larger than 1000px I don’t get a warning. This is my code:

    //Name validation (this is OK)

    $realname = $this->getFileName();
    $realname = Normalizer::normalize($realname);
    setlocale(LC_ALL,'bs_BA.UTF-8'); 
    $onlyname = pathinfo($realname, PATHINFO_FILENAME); 
    //Create list of all names
    $db = JFactory::getDbo();
    $query = $db->getQuery(true);
    $query->select('eio3k_peaks.peak_name');
    $query->from($db->quoteName('#__peaks'));
    $db->setQuery($query);
    $peaks_list = $db->loadColumn();

    if (!in_array($onlyname, $peaks_list))
    {

        return array('error' => JText::_('The name of this photo "' .$onlyname. '" is incorrect.'));
        
    }
    
    
    //Size validation (this is not ok)

    $dir = 'https://mysite.com/uploads/';
    $image_filename = $dir . $realname;
    list($width, $height) = getimagesize($image_filename);
    if (($width > 1000) OR ($height > 1000))
        {
        return array('error' => JText::_('The photo is larger than 1000px'));
        }

Where I went wrong? This is just the code I added. I can set up a complete file, but it's more than 250 lines of code

Answer 1

I think I have a good idea where the error is. You are using $this->getFileName() to get the files original name, then you mutate the filename using normalize(). At this point you have a new file name, but the system doesn't realise that this is the filename to be used forevermore.

Basically, you will either need to rename the file in your file system to the new normalised filename, or you will need to reference the old/original filename when you want to fetch the dimensions. ...At some point you are going to need to save the new file name to the system.

I recommend that you implement your peak_name check purely in sql instead of extracting all peak names from your database and making the in_array() check in php.

Also, for performance reasons, I recommend that you check the dimensions BEFORE making a trip to the database. In general terms, I write "less expensive" processes before processes that consume more resources.

Finally, I will urge you to check the file type before doing either of these checks.

Untested suggestion...

$fileName = $this->getFileName();

if (max(array_slice(getimagesize('https://mysite.com/uploads/' . $fileName), 0, 2)) > 1000) {
    return [
        'error' => JText::_('The photo is larger than 1000px'
    ];
}

$newName = Normalizer::normalize($fileName);
setlocale(LC_ALL, 'bs_BA.UTF-8'); 
$newNameNoExtension = pathinfo($newName, PATHINFO_FILENAME); 

$db = JFactory::getDbo();
$query = $db
    ->getQuery(true)
    ->select("COUNT(1)")
    ->from($db->quoteName("#__peaks"))
    ->where($db->quoteName("peak_name") . " = " . $db->quote($newNameNoExtension));
$db->setQuery($query);

if (!$db->loadResult) {
    return [
        'error' => JText::_('The name of this photo "' . $newNameNoExtension . '" is invalid.'
    ];
}

Relevant notes from the PHP Docs:

getimagesize():

Caution This function expects filename to be a valid image file. If a non-image file is supplied, it may be incorrectly detected as an image and the function will return successfully, but the array may contain nonsensical values.

Do not use getimagesize() to check that a given file is a valid image. Use a purpose-built solution such as the Fileinfo extension instead.

and

Returns an array with up to 7 elements. Not all image types will include the channels and bits elements.

Index 0 and 1 contains respectively the width and the height of the image.