Merge pull request #1164 from mattburnett-repo/670

 Issue 670. Image Upload Validation.

Author: andrewtavis

.env.dev

@@ -1,5 +1,6 @@
 FRONTEND_PORT="3000"
 VITE_FRONTEND_URL="http://localhost:3000"
+VITE_BACKEND_URL="http://localhost:8000"
 VITE_API_URL="http://localhost:8000/v1"
 
 ADMIN_PATH="admin/"

.gitignore

@@ -18,7 +18,7 @@ venv/
 .mypy_cache
 
 # Don't include migrations for now.
-*migrations/*
+**/migrations/*
 !*migrations/__init__.py
 
 # Testing

backend/authentication/models.py

@@ -83,7 +83,7 @@ class Support(models.Model):
     creation_date = models.DateTimeField(auto_now_add=True)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class UserModel(AbstractUser, PermissionsMixin):

backend/communities/groups/models.py

@@ -51,7 +51,7 @@ class GroupImage(models.Model):
     sequence_index = models.IntegerField()
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class GroupMember(models.Model):
@@ -68,7 +68,7 @@ class GroupMember(models.Model):
     is_comms = models.BooleanField(default=False)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class GroupSocialLink(SocialLink):

backend/communities/organizations/models.py

@@ -68,7 +68,7 @@ class OrganizationApplication(models.Model):
     creation_date = models.DateTimeField(auto_now_add=True)
 
     def __str__(self) -> str:
-        return f"{self.creation_date}"
+        return str(self.creation_date)
 
 
 class OrganizationApplicationStatus(models.Model):
@@ -85,7 +85,7 @@ class OrganizationImage(models.Model):
     sequence_index = models.IntegerField()
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class OrganizationMember(models.Model):
@@ -96,7 +96,7 @@ class OrganizationMember(models.Model):
     is_comms = models.BooleanField(default=False)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class OrganizationSocialLink(SocialLink):
@@ -114,7 +114,7 @@ class OrganizationTask(models.Model):
     )
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class OrganizationText(models.Model):

backend/content/models.py

@@ -3,6 +3,8 @@
 Models for the content app.
 """
 
+import os
+from typing import Any
 from uuid import uuid4
 
 from django.contrib.postgres.fields import ArrayField
@@ -24,7 +26,7 @@ class Discussion(models.Model):
     tags = models.ManyToManyField("content.Tag", blank=True)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class Faq(models.Model):
@@ -40,15 +42,25 @@ def __str__(self) -> str:
         return self.question
 
 
+# This is used to set the filename to the UUID of the model, in the Image model.
+def set_filename_to_uuid(instance: Any, filename: str) -> str:
+    """Generate a new filename using the model's UUID and keep the original extension."""
+    ext = os.path.splitext(filename)[1]  # extract file extension
+    new_filename = f"{instance.id}{ext}"  # use model UUID as filename
+
+    return os.path.join("images/", new_filename)  # store in 'images/' folder
+
+
 class Image(models.Model):
     id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
     file_object = models.ImageField(
-        upload_to="images/", validators=[validate_image_file_extension]
+        upload_to=set_filename_to_uuid,
+        validators=[validate_image_file_extension],
     )
     creation_date = models.DateTimeField(auto_now_add=True)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class Location(models.Model):
@@ -61,7 +73,7 @@ class Location(models.Model):
     display_name = models.CharField(max_length=255)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class Resource(models.Model):
@@ -117,7 +129,7 @@ class Tag(models.Model):
     creation_date = models.DateTimeField(auto_now_add=True)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)
 
 
 class Task(models.Model):
@@ -163,4 +175,4 @@ class DiscussionEntry(models.Model):
     deletion_date = models.DateTimeField(blank=True, null=True)
 
     def __str__(self) -> str:
-        return f"{self.id}"
+        return str(self.id)

backend/content/serializers.py

@@ -3,11 +3,16 @@
 Serializers for the content app.
 """
 
+from io import BytesIO
 from typing import Any, Dict, Union
 
+from django.conf import settings
+from django.core.files.uploadedfile import InMemoryUploadedFile, UploadedFile
 from django.utils.translation import gettext as _
+from PIL import Image as PILImage
 from rest_framework import serializers
 
+from communities.organizations.models import OrganizationImage
 from content.models import (
     Discussion,
     DiscussionEntry,
@@ -34,31 +39,86 @@ class Meta:
         fields = "__all__"
 
 
+# MARK: Clear Metadata
+
+
+def scrub_exif(image_file: InMemoryUploadedFile) -> InMemoryUploadedFile:
+    """
+    Remove EXIF metadata from JPEGs and text metadata from PNGs.
+    """
+    try:
+        img: PILImage.Image = PILImage.open(image_file)
+        output_format = img.format
+
+        if output_format == "JPEG":
+            img = img.convert("RGB")
+
+        elif output_format == "PNG":
+            img = img.copy()
+            img.info = {}
+
+        else:
+            return image_file  # return as-is if it's not JPEG or PNG
+
+        # Save the cleaned image into a buffer.
+        output = BytesIO()
+        img.save(
+            output,
+            format=output_format,
+            quality=95 if output_format == "JPEG" else None,  # set JPEG quality
+            optimize=output_format == "JPEG",  # optimize JPEG
+        )
+        output.seek(0)
+
+        # Return a new InMemoryUploadedFile
+        return InMemoryUploadedFile(
+            output,
+            image_file.field_name,  # use original field name
+            image_file.name,
+            f"image/{output_format.lower()}",
+            output.getbuffer().nbytes,
+            image_file.charset,  # preserve charset (if applicable)
+        )
+
+    except Exception as e:
+        print(f"Error scrubbing EXIF: {e}")
+        return image_file  # return original file in case of error
+
+
 class ImageSerializer(serializers.ModelSerializer[Image]):
     class Meta:
         model = Image
         fields = ["id", "file_object", "creation_date"]
         read_only_fields = ["id", "creation_date"]
 
-    def validate(self, data: Dict[str, Union[str, int]]) -> Dict[str, Union[str, int]]:
-        # Remove string validation since we're getting a file object.
+    def validate(self, data: Dict[str, UploadedFile]) -> Dict[str, UploadedFile]:
         if "file_object" not in data:
             raise serializers.ValidationError("No file was submitted.")
 
+        # DATA_UPLOAD_MAX_MEMORY_SIZE and IMAGE_UPLOAD_MAX_FILE_SIZE are set in core/settings.py.
+        # The file size limit is not being enforced. We're checking the file size here.
+        if (
+            data["file_object"].size is not None
+            and data["file_object"].size > settings.IMAGE_UPLOAD_MAX_FILE_SIZE
+        ):
+            raise serializers.ValidationError(
+                f"The file size ({data['file_object'].size} bytes) is too large. The maximum file size is {settings.IMAGE_UPLOAD_MAX_FILE_SIZE} bytes."
+            )
+
         return data
 
     # Using 'Any' type until a more correct type is determined.
     def create(self, validated_data: Dict[str, Any]) -> Image:
-        if file_obj := self.context["request"].FILES.get("file_object"):
-            validated_data["file_object"] = file_obj
+        request = self.context["request"]
 
-        # Create the image first.
-        image = super().create(validated_data)
+        if file_obj := request.FILES.get("file_object"):
+            validated_data["file_object"] = scrub_exif(file_obj)
 
-        if organization_id := self.context["request"].data.get("organization_id"):
-            # Create OrganizationImage with next sequence index.
-            from communities.organizations.models import OrganizationImage
+        # Create the image instance.
+        image = super().create(validated_data)
 
+        # Handle organization image indexing if applicable.
+        if organization_id := request.data.get("organization_id"):
             next_index = OrganizationImage.objects.filter(
                 org_id=organization_id
             ).count()