diff --git a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php index afaa28be0a7f01f87ccc832202723a2e15939e49..883c1abc1c1d1ee66ff0418ff9e7a574ac330332 100644 --- a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php +++ b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php @@ -20,10 +20,28 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac $saveLogo = $status = true; if(!empty($_FILES['logo']['name'])) { $logoDetails = $_FILES['logo']; - $saveLogo = Vtiger_Functions::validateImage($logoDetails); - if (is_string($saveLogo)) $saveLogo = ($saveLogo == 'false')? false : true; + $fileType = explode('/', $logoDetails['type']); + $fileType = $fileType[1]; - if ($saveLogo) { + if (!$logoDetails['size'] || !in_array($fileType, Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { + $saveLogo = false; + } + + if ($saveLogo) { + //mime type check + $mimeType = mime_content_type($logoDetails['tmp_name']); + $mimeTypeContents = explode('/', $mimeType); + if ($mimeTypeContents[0] != 'image' || !in_array($mimeTypeContents[1], Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { + $saveLogo = false; + } + } + + if ($saveLogo) { + $saveLogo = Vtiger_Functions::validateImage($logoDetails); + if (is_string($saveLogo)) $saveLogo = ($saveLogo == 'false')? false : true; + } + + if ($saveLogo) { $moduleModel->saveLogo(); } }else{