Serve stored images safely and drop committed uploads.

display.php takes the type from the image data, refuses anything else,
and sends nosniff. Remove the nine uploads in graphics/tmp.

.gitignore

@@ -1,2 +1,5 @@
 # Local configuration and secrets (see .env.example)
 .env
+
+# Old upload directory; uploads now go to UPLOAD_DIR outside the web root
+graphics/tmp/

display.php

@@ -64,17 +64,21 @@ function display_img($id) {
 
   $row = $result->fetch_assoc();
   if ($row) {
-    $img_data = $row['img'];
+    $img_data = (string)$row['img'];
-    $mimetype = $row['mime'];
 
-    ob_start();
+    // Serve only real images, with the type found in the data itself (not
+    // the stored one), and stop browsers from guessing another type
+    $info = @getimagesizefromstring($img_data);
+    if (!$info) {
+      header("HTTP/1.1 404 Not Found");
+      $result->close();
+      return;
+    }
+
+    header("Content-type: ".$info['mime']);
+    header("Content-length: ".strlen($img_data));
+    header("X-Content-Type-Options: nosniff");
     print $img_data;
-    $size = ob_get_length();
-    $img  = ob_get_clean();
-
-    header("Content-type: $mimetype");
-    header("Content-length: $size");
-    print $img;
 
   } else {
     header("HTTP/1.1 404 Not Found");