From b11c7c2845bd927744a6a7c4a3e474cc10b4a27e Mon Sep 17 00:00:00 2001
From: BBaoVanC <github@bbaovanc.com>
Date: Tue, 24 Nov 2020 17:51:37 -0600
Subject: [PATCH] Strip EXIF from image before saving

---
 imgupload.py     | 10 +++++++++-
 requirements.txt |  1 +
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/imgupload.py b/imgupload.py
index 9e82205..abc3831 100644
--- a/imgupload.py
+++ b/imgupload.py
@@ -10,6 +10,7 @@ from flask_api import status
 from pathlib import Path
 import os
 import datetime
+from PIL import Image
 
 import settings  # app settings (such as allowed extensions)
 import functions  # custom functions
@@ -88,7 +89,14 @@ def upload():
                         if Path(os.path.join(settings.UPLOAD_FOLDER, fname)).is_file():
                             print("Requested filename already exists!")
                             return jsonify({'status': 'error', 'error': 'FILENAME_TAKEN'}), status.HTTP_409_CONFLICT
-                        f.save(os.path.join(settings.UPLOAD_FOLDER, fname))  # save the image
+
+                        f.save(f"/tmp/{fname}")  # save the image temporarily (before removing EXIF)
+                        image = Image.open(f"/tmp/{fname}")
+                        data = list(image.getdata())
+                        stripped = Image.new(image.mode, image.size)
+                        stripped.putdata(data)
+                        stripped.save(os.path.join(settings.UPLOAD_FOLDER, fname))  # save the image without EXIF
+
                         print(f"Saved to {fname}")
                         url = settings.ROOTURL + fname  # construct the url to the image
                         if settings.SAVELOG != "/dev/null":
diff --git a/requirements.txt b/requirements.txt
index 7d9b535..4f9c685 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,3 @@
 Flask_API==2.0
 Flask==1.1.2
+Pillow==8.0.1