    public function uploadCustomLogoAction(Request $request)
    {
        $sourcePath = $_FILES['Filedata']['tmp_name'];
        $fileExt = File::getFileExtension($_FILES['Filedata']['name']);
        if (!in_array($fileExt, ['svg', 'png', 'jpg'])) {
            throw new \Exception('Unsupported file format');
        }


        $storage = Tool\Storage::get('admin');

        $fileMimeType = MimeTypes::getDefault()->guessMimeType($sourcePath);

        if ($fileMimeType === 'image/svg+xml') {
            $fileContent = file_get_contents($sourcePath);

            $sanitizer = new Sanitizer();
            $sanitizedFileContent = $sanitizer->sanitize($fileContent);
            if ($sanitizedFileContent) {
                $storage->write(self::CUSTOM_LOGO_PATH, $sanitizedFileContent);
            }else{
                throw new \Exception('SVG Sanitization failed, probably due badly formatted XML. Filename:'.$sourcePath);
            }
        }else {
            $storage->writeStream(self::CUSTOM_LOGO_PATH, fopen($sourcePath, 'rb'));
        }

        // set content-type to text/html, otherwise (when application/json is sent) chrome will complain in
        // Ext.form.Action.Submit and mark the submission as failed

        $response = $this->adminJson(['success' => true]);
        $response->headers->set('Content-Type', 'text/html');

        return $response;
    }
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.