fix: strip exif data on image uploads

src/controllers/uploads.js

@@ -58,6 +58,9 @@ function uploadAsImage(req, uploadedFile, callback) {
 			}
 			image.checkDimensions(uploadedFile.path, next);
 		},
+		function (next) {
+			image.stripEXIF(uploadedFile.path, next);
+		},
 		function (next) {
 			if (plugins.hasListeners('filter:uploadImage')) {
 				return plugins.fireHook('filter:uploadImage', {

src/image.js

@@ -5,6 +5,7 @@ var fs = require('fs');
 var path = require('path');
 var crypto = require('crypto');
 var async = require('async');
+var winston = require('winston');
 
 var file = require('./file');
 var plugins = require('./plugins');
@@ -90,6 +91,26 @@ image.size = function (path, callback) {
 	}
 };
 
+image.stripEXIF = function (path, callback) {
+	async.waterfall([
+		function (next) {
+			fs.readFile(path, next);
+		},
+		function (buffer, next) {
+			const sharp = requireSharp();
+			const sharpImage = sharp(buffer, {
+				failOnError: true,
+			});
+			sharpImage.rotate().toFile(path, next);
+		},
+	], function (err) {
+		if (err) {
+			winston.error(err);
+		}
+		callback();
+	});
+};
+
 image.checkDimensions = function (path, callback) {
 	const meta = require('./meta');
 	image.size(path, function (err, result) {