Routing image validation in CompanyDetailsSave action to common function.

modules/Settings/Vtiger/actions/CompanyDetailsSave.php

@@ -19,25 +19,10 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac
         if ($request->get('organizationname')) {
             $saveLogo = $status = true;
 			if(!empty($_FILES['logo']['name'])) {
-                $logoDetails = $_FILES['logo'];
-                $fileType = explode('/', $logoDetails['type']);
-                $fileType = $fileType[1];
+				$logoDetails = $_FILES['logo'];
+				$saveLogo = Vtiger_Functions::validateImage($logoDetails);
+				if (is_string($saveLogo)) $saveLogo = ($saveLogo == 'false')? false : true;
 
-                if (!$logoDetails['size'] || !in_array($fileType, Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { 
-                    $saveLogo = false; 
-                } 
-
-                //mime type check 
-                $mimeType = vtlib_mime_content_type($logoDetails['tmp_name']); 
-                $mimeTypeContents = explode('/', $mimeType); 
-                if (!$logoDetails['size'] || $mimeTypeContents[0] != 'image' || !in_array($mimeTypeContents[1], Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { 
-                    $saveLogo = false; 
-                } 
-				// Check for php code injection
-				$imageContents = file_get_contents($_FILES["logo"]["tmp_name"]);
-				if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) {
-					$saveLogo = false;
-				}
                 if ($saveLogo) {
                     $moduleModel->saveLogo();
                 }

vtlib/Vtiger/Functions.php

@@ -606,7 +606,7 @@ class Vtiger_Functions {
 		}
 
 		//mime type check
-		$mimeType = mime_content_type($file_details['tmp_name']);
+		$mimeType = self::mime_content_type($file_details['tmp_name']);
 		$mimeTypeContents = explode('/', $mimeType);
 		if (!$file_details['size'] || strtolower($mimeTypeContents[0]) !== 'image' || !in_array($mimeTypeContents[1], $mimeTypesList)) {
 			$saveimage = 'false';