Resizing Images in the Gentics Portal.Node Server consumes processing time. Therefore, unsecured requests to resize images may open the Server for DoS attacks.
With the Image Resize Validation feature, the “GenticsImageStore” (Section 15), “GenticsContentPortlet” (Section 5) and “GenticsContentModule” (Section 4) will no longer
accept requests to resize images, unless they contain a certain checksum as validation
request parameter.
The Feature is activated by setting the parameter secret
(as pnode parameter for the portlets or init-param for the servlet) to a non-empty String value.
Once activated, all requests to resized images must be validated by adding the request parameter validation
.
The parameter must be constructed as
SHA256([secret][resizepath])
encoded with two-digit hexcode (leading zeros).
Where [resizepath]
is the path containing the resize properties:
Example 3.26. Validating Image Resize Requests
Request to /GenticsImageStore/100/auto/prop/images/image.png must be validated with SHA256([secret]/100/auto/prop) e.g. (with "secret" as the secret): /GenticsImageStore/100/auto/prop/images/image.png?validation=55364166F44A14AC9AE70E86C600A30BB7A8044F59C56D9426BA495D579495CF
Request to /GenticsImageStore/auto/200/cropandresize/smart/10/10/100/100/images/image.png must be validated with SHA256([secret]/auto/200/cropandresize/smart/10/10/100/100) e.g. (with "secret" as the secret): /GenticsImageStore/auto/200/cropandresize/smart/10/10/100/100/images/image.png?validation=3B9C74C7FE34F5C18DA640D897A60193FC2CC4704B3C9CC252594483C030706D
Request to /Portal.Node/portal?gentics.rs=content&gentics.rsid=10008.1&maxwidth=100 must be validated with SHA256([secret]/100/auto/prop) e.g. (with "secret" as the secret): /Portal.Node/portal?gentics.rs=content&gentics.rsid=10008.1&maxwidth=100&validation=55364166F44A14AC9AE70E86C600A30BB7A8044F59C56D9426BA495D579495CF
Unvalidated or incorrectly validated requests will get a response with status 403 (Forbidden)
.
![]() | Note |
---|---|
The GenticsContentPortlet an GenticsContentModule will always use prop as resize mode. If either maxwidth or maxheight is not given, the value auto is assumed.
|