Ensure uploaded images are image files

[kbrock]

Consolidated catalog uploads and icon uploads.
Checking image magic numbers to ensure it is a png or jpg

Resolves issue where user could upload a zip bomb

This only addresses

Tested with jpg, gif, png, and zip files

[Fryguy]

Alternatively, File.extname

[kbrock]

File.extname keeps the ".".
When I changed the code over to that it ended up changing too much.

Deciding to keep it the way it was when I came in

[kbrock]

update:

• fixed @param descriptions
• dropped Concern`
• use File.extname
• moved ext to the else
• flattened 1 layer of ifs in the controller

update:

• revert File.extname() => split(".").last. (it doesn't have a "." in the resulting extension.

[Fryguy]

@kbrock Are there specs for this? I think the original valid_file? code had specs, which could be moved as a direct test of this mixin.

Maybe this one from #8934 ?

[kbrock]

update:

• introduced fixtures directory with images (and mis-typed images)
• testing that catalog does not allow non-image uploads (by file type and not by file name)

[Fryguy]

If I recall correctly, this was intentionally a .txt file and not a .png file (regardless of the guts of the file) to demonstrate neither .png nor .jpg.

So I'm wondering if this should be

Suggested change

	file = fixture_file_upload('files/upload_image.txt', 'image/png')
	file = fixture_file_upload('spec/fixtures/test.txt.png')
	file = fixture_file_upload('spec/fixtures/test.txt')

[kbrock]

Your comment does makes a lot of sense.

But the upload_spec.rb uses the name test.txt.png to show that the controller is validating the file contents and not the file extension/mime type.

Before #8934 test.txt.png incorrectly would work. Using that filename shows that we are validating the contents and not the filename itself.

This PR adds similar validation, so I think the new file with an image extension but contents that are not an image makes sense.

I did update this line to use the image mime-type.

[Fryguy]

Skipping backport to radjabov, because it is already in the branch.