0
\$\begingroup\$

My try:

import base64
from django.core.files.base import ContentFile

def form_valid(self, form):
    self.object = form.save(commit=False)
    if self.request.POST.get('image_as_base64', None):
        format, imgstr = self.request.POST.get('image_as_base64').split(';base64,')
        ext = format.split('/')[-1]

        data = ContentFile(base64.b64decode(imgstr))
        file_name = "'temp_name." + ext
        self.object.receipt.save(file_name, data, save=True)

Do you see any security problems?

The value in the frontend is generated in this way (Vue.js method):

 saveMapAsImage() {
    this.printPlugin.printMap('A4Portrait page', 'Miles');
    self = this;
    this.routingMap.on('easyPrint-finished', e => {
        var reader = new window.FileReader();
        reader.readAsDataURL(e.event); // e.event is a Blob object generated via leaflet-easyPrint
        reader.onloadend = function () {
             base64data = reader.result;
             self.image_as_base64 = base64data;
        }
    });
  }

HTML

<input v-model="image_as_base64" type="hidden" id="id_image_as_base64" name="image_as_base64"/>
\$\endgroup\$
  • 2
    \$\begingroup\$ "Secure" can mean a lot of different things. What is your threat model? \$\endgroup\$ – AlexV Feb 24 at 16:38
  • 1
    \$\begingroup\$ Why are you saving it in base64? It increases the size of the image and usually can't be cached properly. \$\endgroup\$ – Edeki Okoh Feb 24 at 16:38
  • \$\begingroup\$ @EdekiOkoh the output file format is .png, I only get base64 from frontend and save as .png \$\endgroup\$ – 12735961238 Feb 24 at 16:50
  • \$\begingroup\$ I'm not clear on what you mean by "secure". Are you worried that the base64 you get from the frontend will not actually be a .png, but some other kind of data? \$\endgroup\$ – MJ713 Feb 25 at 1:08
  • \$\begingroup\$ @MJ713 yes, this is one possible problem \$\endgroup\$ – 12735961238 Feb 25 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.