check type of "size" before generate thumbnail

seahub/thumbnail/utils.py

@@ -70,6 +70,12 @@ def generate_thumbnail(request, repo_id, size, path):
     """ generate and save thumbnail if not exist
     """
 
+    try:
+        size = int(size)
+    except ValueError as e:
+        logger.error(e)
+        return False
+
     thumbnail_dir = os.path.join(THUMBNAIL_ROOT, str(size))
     if not os.path.exists(thumbnail_dir):
         os.makedirs(thumbnail_dir)

seahub/thumbnail/views.py

@@ -88,6 +88,12 @@ def thumbnail_get(request, repo_id, size, path):
     return thumbnail file to web
     """
 
+    try:
+        size = int(size)
+    except ValueError as e:
+        logger.error(e)
+        return HttpResponse()
+
     if check_folder_permission(request, repo_id, path) is None:
         return HttpResponse()
 
@@ -184,6 +190,12 @@ def share_link_thumbnail_get(request, token, size, path):
     return thumbnail file to web
     """
 
+    try:
+        size = int(size)
+    except ValueError as e:
+        logger.error(e)
+        return HttpResponse()
+
     fileshare = FileShare.objects.get_valid_file_link_by_token(token)
     if not fileshare:
         return HttpResponse()