Fix optimize_thumbnail raises Detected path traversal attempt (#633)

[bmihelac]

No description provided.

[benkonrath]

I hit this issue and I can confirm that this PR is working well.

[MHM5000]

Is there any chance this could go to master today? and a new version could be released?

[PetrDlouhy]

Hm. Now I see that this is not fix for all problems caused by the fixes of CVE-2024-39330.
Tests here were run before the testing matrix update to Django 4.2+.
Tests still do fail on django.core.exceptions.SuspiciousFileOperation, so I expect there are other places where path is used instead of name, I will try to investigate.

@jrief The tests are also not passing because of this:

The KeyError: 0 is caused by commit fe51af8 which changes number of version parameters.

[bmihelac]

@PetrDlouhy I'll check this too. When I was looking at the issue I installed the package it as editable and tested against website with latest Django 4.2.+

[PetrDlouhy]

@bmihelac I didn't find a solution so far. The problem is with ImageClearableFileInput, so you might not have it in the testing project. I am still not sure if it is just problem with tests or if it is problem also on real projects.

[PetrDlouhy]

@bmihelac I am also wondering. If this didn't fix the tests is the the fix covered? Maybe we should add a test that would fail if the fix is not present.

[bmihelac]

I am also wondering. If this didn't fix the tests is the the fix covered? Maybe we should add a test that would fail if the fix is not present.

Tests exists but unfortunately they were not run with Django 4.2.14 as you noted in #634 (comment)

The second issue is that specific tests were not run in the local environment if the testfixtures package was not installed. I added a pull request regarding this issue:

#640