nik/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-18 07:30:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(jellyfin): return 400 for an avatar body that is not a decodable image

Browse Source 
The native endpoint answers 400 for the same input; only SetAvatar's resize was
catching it here, which surfaced as 500.
This commit is contained in:
Deluan 2026-09-07 21:00:32 -04:00
parent 114208e6d6
commit 56ec411cae
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
server/jellyfin/user_image.go
View File

@ -2,6 +2,7 @@ package jellyfin
import (
"bytes"
"image"
"io"
"net/http"
"strings"
@ -140,6 +141,12 @@ func (api *Router) postUserImage(w http.ResponseWriter, r *http.Request) {
return
}
if _, _, err := image.DecodeConfig(bytes.NewReader(imgBytes)); err != nil {
log.Warn(ctx, "Jellyfin API: avatar upload rejected: not a valid image", "user", usr.UserName, err)
http.Error(w, "invalid image file", http.StatusBadRequest)
return
}
filename, err := api.imgUpload.SetAvatar(ctx, usr.ID, usr.UserName, usr.UploadedImagePath(), bytes.NewReader(imgBytes), ext)
if err != nil {
log.Error(ctx, "Jellyfin API: could not save avatar", "user", usr.UserName, err)

12
server/jellyfin/user_image_test.go
View File

@ -202,6 +202,18 @@ var _ = Describe("POST /userimage and DELETE /userimage", func() {
Expect(usr.UploadedImage).To(BeEmpty())
})
It("rejects a body that is not a decodable image with 400", func() {
body := base64.StdEncoding.EncodeToString([]byte("this is not an image"))
r := authenticatedRequestWithBody("POST", "/userimage", strings.NewReader(body))
r.Header.Set("Content-Type", "image/png")
w := httptest.NewRecorder()
router.ServeHTTP(w, r)
Expect(w.Code).To(Equal(http.StatusBadRequest))
usr, _ := ds.User(context.Background()).Get("u1")
Expect(usr.UploadedImage).To(BeEmpty())
})
It("rejects an unknown content type", func() {
r := authenticatedRequestWithBody("POST", "/userimage", strings.NewReader("x"))
r.Header.Set("Content-Type", "text/plain")