From: vincent@cubedesigners.com <vincent@cubedesigners.com@f5622870-0f3c-0410-866d-9cb505b7a8ef>
Date: Wed, 7 Dec 2022 11:50:51 +0000 (+0000)
Subject: wait #5630 @0.75
X-Git-Url: http://git.cubedesigners.com/?a=commitdiff_plain;h=5af232fb2b905cd2397299d932f3bfd6b5690aa6;p=cubeextranet.git

wait #5630 @0.75
---

diff --git a/.docker/config/imagemagick/policy.xml b/.docker/config/imagemagick/policy.xml
new file mode 100644
index 000000000..a7622022b
--- /dev/null
+++ b/.docker/config/imagemagick/policy.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policymap [
+        <!ELEMENT policymap (policy)+>
+        <!ATTLIST policymap xmlns CDATA #FIXED ''>
+        <!ELEMENT policy EMPTY>
+        <!ATTLIST policy xmlns CDATA #FIXED '' domain NMTOKEN #REQUIRED
+                name NMTOKEN #IMPLIED pattern CDATA #IMPLIED rights NMTOKEN #IMPLIED
+                stealth NMTOKEN #IMPLIED value CDATA #IMPLIED>
+        ]>
+<!--
+  Configure ImageMagick policies.
+
+  Domains include system, delegate, coder, filter, path, or resource.
+
+  Rights include none, read, write, execute and all.  Use | to combine them,
+  for example: "read | write" to permit read from, or write to, a path.
+
+  Use a glob expression as a pattern.
+
+  Suppose we do not want users to process MPEG video images:
+
+    <policy domain="delegate" rights="none" pattern="mpeg:decode" />
+
+  Here we do not want users reading images from HTTP:
+
+    <policy domain="coder" rights="none" pattern="HTTP" />
+
+  The /repository file system is restricted to read only.  We use a glob
+  expression to match all paths that start with /repository:
+
+    <policy domain="path" rights="read" pattern="/repository/*" />
+
+  Lets prevent users from executing any image filters:
+
+    <policy domain="filter" rights="none" pattern="*" />
+
+  Any large image is cached to disk rather than memory:
+
+    <policy domain="resource" name="area" value="1GP"/>
+
+  Define arguments for the memory, map, area, width, height and disk resources
+  with SI prefixes (.e.g 100MB).  In addition, resource policies are maximums
+  for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
+  exceeds policy maximum so memory limit is 1GB).
+
+  Rules are processed in order.  Here we want to restrict ImageMagick to only
+  read or write a small subset of proven web-safe image types:
+
+    <policy domain="delegate" rights="none" pattern="*" />
+    <policy domain="filter" rights="none" pattern="*" />
+    <policy domain="coder" rights="none" pattern="*" />
+    <policy domain="coder" rights="read|write" pattern="{GIF,JPEG,PNG,WEBP}" />
+-->
+<policymap>
+    <!-- <policy domain="system" name="shred" value="2"/> -->
+    <!-- <policy domain="system" name="precision" value="6"/> -->
+    <!-- <policy domain="system" name="memory-map" value="anonymous"/> -->
+    <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
+    <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
+    <policy domain="resource" name="memory" value="2GiB"/>
+    <policy domain="resource" name="map" value="4GiB"/>
+    <policy domain="resource" name="width" value="128KP"/>
+    <policy domain="resource" name="height" value="128KP"/>
+    <!-- <policy domain="resource" name="list-length" value="128"/> -->
+    <policy domain="resource" name="area" value="1.0737GP"/>
+    <policy domain="resource" name="disk" value="16GiB"/>
+    <policy domain="resource" name="file" value="768"/>
+    <policy domain="resource" name="thread" value="8"/>
+    <policy domain="resource" name="throttle" value="0"/>
+    <!-- <policy domain="resource" name="time" value="3600"/> -->
+    <!-- <policy domain="coder" rights="none" pattern="MVG" /> -->
+    <!-- <policy domain="module" rights="none" pattern="{PS,PDF,XPS}" /> -->
+    <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> -->
+    <!-- <policy domain="path" rights="none" pattern="@*" /> -->
+    <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
+    <!-- <policy domain="cache" name="synchronize" value="True"/> -->
+    <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+    <!-- <policy domain="system" name="pixel-cache-memory" value="anonymous"/> -->
+    <!-- <policy domain="system" name="shred" value="2"/> -->
+    <!-- <policy domain="system" name="precision" value="6"/> -->
+    <!-- not needed due to the need to use explicitly by mvg: -->
+    <!-- <policy domain="delegate" rights="none" pattern="MVG" /> -->
+    <!-- use curl -->
+    <policy domain="delegate" rights="none" pattern="URL" />
+    <policy domain="delegate" rights="none" pattern="HTTPS" />
+    <policy domain="delegate" rights="none" pattern="HTTP" />
+    <!-- in order to avoid to get image with password text -->
+    <policy domain="path" rights="none" pattern="@*"/>
+    <!-- disable ghostscript format types -->
+    <policy domain="coder" rights="none" pattern="PS" />
+    <policy domain="coder" rights="none" pattern="PS2" />
+    <policy domain="coder" rights="none" pattern="PS3" />
+    <policy domain="coder" rights="none" pattern="EPS" />
+    <policy domain="coder" rights="none" pattern="PDF" />
+    <policy domain="coder" rights="none" pattern="XPS" />
+</policymap>
\ No newline at end of file
diff --git a/.docker/docker-compose.yml b/.docker/docker-compose.yml
index af7943451..38e5d915b 100644
--- a/.docker/docker-compose.yml
+++ b/.docker/docker-compose.yml
@@ -118,6 +118,8 @@ services:
       - '/home/extranet/.docker/config/cron/crontab:/etc/crontab'
       # Passwords
       - '/home/extranet/.docker/config/passwords:/root/passwords'
+      # ImageMagick
+      - '/home/extranet/.docker/config/imagemagick/policy.xml:/etc/ImageMagick-6/policy.xml'
       # Files
       - '/data/extranet/ftp:/ftp'
       - '/home/extranet/fonts/:/fonts/'
diff --git a/inc/ws/Util/html5/master/class.ws.html5.links.php b/inc/ws/Util/html5/master/class.ws.html5.links.php
index 43e9144fa..e42f6c6e4 100644
--- a/inc/ws/Util/html5/master/class.ws.html5.links.php
+++ b/inc/ws/Util/html5/master/class.ws.html5.links.php
@@ -2928,6 +2928,10 @@ class zoomLink extends normalLink
             array('x' => $x, 'y' => $y, 'width' => $w, 'height' => $h),
             $left, $extractOptions, WS_CACHE . '/' . $cachedir . '/' . $compiler->book_id . '/');
 
+        if (!file_exists($leftfile)) {
+            die('Error generating left part ' . $leftfile);
+        }
+
         if (($x + $w) > $bookwidth) {
             if (!isset($attributes['pdf']) || !$attributes['pdf']) {
                 $p = wsDAOBook::getDocumentPage($compiler->book_id, $attributes['page'] + 1);