commit 16c1406

Discard avatar uploads that are not images.

 1@@ -2415,20 +2415,24 @@ int html_post_handler(const xs_dict *req, const char *q_path,
 2 
 3         /* avatar upload */
 4         xs_list *avatar_file = xs_dict_get(p_vars, "avatar_file");
 5-        if (!xs_is_null(avatar_file) && xs_type(avatar_file) == XSTYPE_LIST) {
 6-            char *fn = xs_list_get(avatar_file, 0);
 7+        if (xs_type(avatar_file) == XSTYPE_LIST) {
 8+            const char *fn = xs_list_get(avatar_file, 0);
 9 
10-            if (*fn != '\0') {
11-                char *ext = strrchr(fn, '.');
12-                xs *id    = xs_fmt("avatar%s", ext);
13-                xs *url   = xs_fmt("%s/s/%s", snac.actor, id);
14-                int fo    = xs_number_get(xs_list_get(avatar_file, 1));
15-                int fs    = xs_number_get(xs_list_get(avatar_file, 2));
16+            if (fn && *fn) {
17+                const char *mimetype = xs_mime_by_ext(fn);
18 
19-                /* store */
20-                static_put(&snac, id, payload + fo, fs);
21+                if (xs_startswith(mimetype, "image/")) {
22+                    const char *ext = strrchr(fn, '.');
23+                    xs *id          = xs_fmt("avatar%s", ext);
24+                    xs *url         = xs_fmt("%s/s/%s", snac.actor, id);
25+                    int fo          = xs_number_get(xs_list_get(avatar_file, 1));
26+                    int fs          = xs_number_get(xs_list_get(avatar_file, 2));
27+
28+                    /* store */
29+                    static_put(&snac, id, payload + fo, fs);
30 
31-                snac.config = xs_dict_set(snac.config, "avatar", url);
32+                    snac.config = xs_dict_set(snac.config, "avatar", url);
33+                }
34             }
35         }
36