diff --git a/seahub/thumbnail/utils.py b/seahub/thumbnail/utils.py index 2a59c8dbe4..c4d16c298a 100644 --- a/seahub/thumbnail/utils.py +++ b/seahub/thumbnail/utils.py @@ -70,6 +70,12 @@ def generate_thumbnail(request, repo_id, size, path): """ generate and save thumbnail if not exist """ + try: + size = int(size) + except ValueError as e: + logger.error(e) + return False + thumbnail_dir = os.path.join(THUMBNAIL_ROOT, str(size)) if not os.path.exists(thumbnail_dir): os.makedirs(thumbnail_dir) diff --git a/seahub/thumbnail/views.py b/seahub/thumbnail/views.py index 22cbdf8f52..7ee0914112 100644 --- a/seahub/thumbnail/views.py +++ b/seahub/thumbnail/views.py @@ -88,6 +88,12 @@ def thumbnail_get(request, repo_id, size, path): return thumbnail file to web """ + try: + size = int(size) + except ValueError as e: + logger.error(e) + return HttpResponse() + if check_folder_permission(request, repo_id, path) is None: return HttpResponse() @@ -184,6 +190,12 @@ def share_link_thumbnail_get(request, token, size, path): return thumbnail file to web """ + try: + size = int(size) + except ValueError as e: + logger.error(e) + return HttpResponse() + fileshare = FileShare.objects.get_valid_file_link_by_token(token) if not fileshare: return HttpResponse()