Skip to content
Snippets Groups Projects
Commit ad74a829 authored by Pierre Paridans's avatar Pierre Paridans
Browse files

[FIX] web: prevent crash on image resize/crop


When attempting to resize or crop an attachment through the '/web/image'
route, if the attachment isn't actually an image (even if the record's
mimetype says so) or doesn't match one of the format supported by PIL
(Python Imaging Library) - like Apple's HEIF -  the request crashes with
a "500 Internal Error".

Although it makes sense to return a response with an HTTP error code, a
more sensible approach would be to return a "404 Not Found" response
instead.

The point by handling the Exception thrown by PIL and returning a 404
status code is to more closely match the semantic of this HTTP status
code. Getting a resized version of a non-image doesn't really make sense
as this resource doesn't exist at all ; hence the "404 Not Found"
response. On the other hand returning a "500 Internal Error" would
denote that a legitimate request failed on the server side, which is not
the case here.

Note: this difference of semantic, even if only visible in a regular
browser, has its importance in the mobile apps because we use it to
given a meaningful feedback to the user in case if failed HTTP requests.

Note: the mimetype detection could be improved to ease the handling of
this kind of errors but would require too much changes to be done in
stable branch.

Steps to reproduce in Discuss:
- rename an HEIF file with a ".jpeg" extension
- upload it in a chat window
=> the thumbnail in the chat window throws an HTTP error 500

opw-2417172

closes odoo/odoo#63772

X-original-commit: 873bc2aa
Related: odoo/enterprise#15462
Signed-off-by: default avatarPierre Paridans <pparidans@users.noreply.github.com>
Signed-off-by: default avatarAdrien Dieudonné (adr) <adr@odoo.com>
parent cdf2d544
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment