[issue2551266] Support limiting POST (file upload) size

New submission from John Rouillard:

With the cgi module you can limit the size of a POST request used for uploading files.

   import cgi

   # Maximum input we will accept when REQUEST_METHOD is POST
   # 0 ==> unlimited input
   cgi.maxlen = 10 * 1024 * 1024 # 10MB

(https://webpy.org/cookbook/limiting_upload_size)

If there is just one file uploaded, this places a maximum size limit
on the file. Roundup can attach multiple files in one POST request.
So this isn't really useful for limiting the attached file size.
An auditor is a better choice to limit attached file size.

However this can be a good defense against a DOS attack for large POST
requests that try to eat all the disk space or memory while handling
the POST.

I suggest adding the setting to the [web] section of the configuration
file. Default value of 0 (no limit, same as current). I think megabyte
units make sense for this. Make value a floating point number, so you
can express kb, bytes etc. if needed. Value is converted to bytes for
use internally.

----------
components: Web interface
keywords: Effort-Low
messages: 7735
nosy: rouilj
severity: normal
status: new
title: Support limiting POST (file upload) size
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551266>
_________________________________________________