- Updates ZIP imports to validate that actual mime type of book cover
images to ensure they are a supported image file.
- Updates lower level ImageStorage to validate extensions of images when
cleaning their name pre-storage.
- Updates ZIP import Image and Book handling so book cover and image
files have their extension forced from file mime types in the same
way.
Added testing to cover.
Thanks to the submersion.ai security research team for reporting.
Had prevented public access for images when secure_restricted images was
enabled (and for just secure images) when app settings allowed public
access.
This considers the app public setting, and adds tests to cover extra
scenarios to prevent regression.
For #5885
Adds to, uses and cleans-up central permission checking in ImageService
to mirror that which would be experienced by users in the UI to result
in the same image access conditions.
Adds testing to cover.
Dan Brown