From d804c6b54ea8f3abcbafbc318d3a068cc1fb7cdf Mon Sep 17 00:00:00 2001
From: Sergey Konovalov <Sergey.Konovalov@onlyoffice.com>
Date: Thu, 11 Jul 2019 15:57:04 +0300
Subject: [PATCH] [bug] Fix bug 41383

---
 Common/sources/utils.js                   | 23 -----------------------
 DocService/sources/canvasservice.js       |  4 ++--
 DocService/sources/fileuploaderservice.js | 10 ++++------
 3 files changed, 6 insertions(+), 31 deletions(-)

diff --git a/Common/sources/utils.js b/Common/sources/utils.js
index 9cd9775c..feacc2ab 100644
--- a/Common/sources/utils.js
+++ b/Common/sources/utils.js
@@ -544,29 +544,6 @@ exports.compareStringByLength = function(x, y) {
   }
   return 0;
 };
-function makeCRCTable() {
-  var c;
-  var crcTable = [];
-  for (var n = 0; n < 256; n++) {
-    c = n;
-    for (var k = 0; k < 8; k++) {
-      c = ((c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1));
-    }
-    crcTable[n] = c;
-  }
-  return crcTable;
-}
-var crcTable;
-exports.crc32 = function(str) {
-  var crcTable = crcTable || (crcTable = makeCRCTable());
-  var crc = 0 ^ (-1);
-
-  for (var i = 0; i < str.length; i++) {
-    crc = (crc >>> 8) ^ crcTable[(crc ^ str.charCodeAt(i)) & 0xFF];
-  }
-
-  return (crc ^ (-1)) >>> 0;
-};
 exports.promiseRedis = function(client, func) {
   var newArguments = Array.prototype.slice.call(arguments, 2);
   return new Promise(function(resolve, reject) {
diff --git a/DocService/sources/canvasservice.js b/DocService/sources/canvasservice.js
index f7a81045..2dbb0f79 100644
--- a/DocService/sources/canvasservice.js
+++ b/DocService/sources/canvasservice.js
@@ -31,7 +31,7 @@
  */
 
 'use strict';
-
+const crypto = require('crypto');
 var pathModule = require('path');
 var urlModule = require('url');
 var co = require('co');
@@ -564,7 +564,7 @@ function* commandImgurls(conn, cmd, outputData) {
           var userid = cmd.getUserId();
           var imageIndex = cmd.getSaveIndex() + imageCount;
           imageCount++;
-          var strLocalPath = 'media/' + utils.crc32(userid).toString(16) + '_';
+          var strLocalPath = 'media/' + crypto.randomBytes(16).toString("hex") + '_';
           if (urlParsed) {
             var urlBasename = pathModule.basename(urlParsed.pathname);
             var displayN = isDisplayedImage(urlBasename);
diff --git a/DocService/sources/fileuploaderservice.js b/DocService/sources/fileuploaderservice.js
index 8cc7419c..22a8cad2 100644
--- a/DocService/sources/fileuploaderservice.js
+++ b/DocService/sources/fileuploaderservice.js
@@ -31,7 +31,7 @@
  */
 
 'use strict';
-
+const crypto = require('crypto');
 var multiparty = require('multiparty');
 var co = require('co');
 var jwt = require('jsonwebtoken');
@@ -121,10 +121,9 @@ exports.uploadImageFileOld = function(req, res) {
       return;
     }
   }
-  var index = parseInt(req.params.index);
   var listImages = [];
   //todo userid
-  if (docId && index) {
+  if (docId) {
     var isError = false;
     var form = new multiparty.Form();
     form.on('error', function(err) {
@@ -144,7 +143,7 @@ exports.uploadImageFileOld = function(req, res) {
           part.resume();
         } else {
           //в начале пишется хеш, чтобы избежать ошибок при параллельном upload в совместном редактировании
-          var strImageName = utils.crc32(userid).toString(16) + '_image' + (parseInt(index) + listImages.length);
+          var strImageName = crypto.randomBytes(16).toString("hex");
           var strPath = docId + '/media/' + strImageName + '.jpg';
           listImages.push(strPath);
           utils.stream2Buffer(part).then(function(buffer) {
@@ -213,7 +212,6 @@ exports.uploadImageFile = function(req, res) {
         }
       }
 
-      var index = parseInt(req.params.index);
       if (isValidJwt && docId && req.body && Buffer.isBuffer(req.body)) {
         let buffer = req.body;
         if (buffer.length <= cfgImageSize) {
@@ -227,7 +225,7 @@ exports.uploadImageFile = function(req, res) {
           }
           if (formatLimit) {
             //в начале пишется хеш, чтобы избежать ошибок при параллельном upload в совместном редактировании
-            var strImageName = utils.crc32(userid).toString(16) + '_image' + index;
+            var strImageName = crypto.randomBytes(16).toString("hex");
             var strPathRel = 'media/' + strImageName + '.' + formatStr;
             var strPath = docId + '/' + strPathRel;
             yield storageBase.putObject(strPath, buffer, buffer.length);