|
8 | 8 | from werkzeug import Response |
9 | 9 | from markupsafe import escape |
10 | 10 |
|
11 | | -from app.gameConfig import BACK_ONLINE_THRESHOLD_S, LOGFILE_VERSION, GroupNotFound |
| 11 | +from app.gameConfig import BACK_ONLINE_THRESHOLD_S, BASE64_PREAMBLE, LOGFILE_VERSION, GroupNotFound |
12 | 12 | from app.model.Participant import Participant |
13 | 13 |
|
14 | 14 | import app.config as gameConfig |
@@ -228,15 +228,18 @@ def saveCanvasImage(): |
228 | 228 | The Request params must contain the pseudonym of the player. The request body shall contain the Base64 encoded PNG snapshot of the players canvas. |
229 | 229 | The pictures are stored under "statistics/<ui>/<phase>/<picNmbr>.png" for most phases and "statistics/<ui>/<phase>/<levelName>/<picNmbr>.png" for the quali and competition phase |
230 | 230 | """ |
231 | | - imgstring = escape(request.form['canvasImage']) |
232 | | - imgstring = imgstring.replace('data:image/png;base64,', '') |
233 | | - imgdata = base64.b64decode(imgstring) |
234 | 231 |
|
235 | 232 | pseudonym = sanitizeString(request.form['pseudonym']) |
236 | | - |
237 | 233 | if not participantsDict.exists(pseudonym): |
238 | 234 | return 'Invalid pseudonym', 400 |
239 | 235 |
|
| 236 | + imgstring = escape(request.form['canvasImage']) |
| 237 | + if not imgstring.startswith(BASE64_PREAMBLE): |
| 238 | + return 'Invalid Image', 400 |
| 239 | + |
| 240 | + imgstring = imgstring.removeprefix(BASE64_PREAMBLE) |
| 241 | + imgdata = base64.b64decode(imgstring) |
| 242 | + |
240 | 243 | participant = participantsDict.get(pseudonym) |
241 | 244 | phase = participant.getPhase() |
242 | 245 | path = ScreenshotWriter.getPath( |
|
0 commit comments