Attachments: max filesize
Georg Lutz <[email protected]> Fri, 3 Sep 2004 15:15:22 +0200
| Newsgroups | gmane.comp.web.wiki.moin.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi,
in order to prevent a DoS situation in an environment, where space on
filesystem is limited (quota), I just hacked some lines.
The changes are minimal:
1. a new configuration variable "attachments_maxsize" (filesize in
bytes) with default value equivalent to 2MB
2. logic in the attach-file action to
- show the maximum filesize in the upload form
- prevent fileuploads with larger size
I think such a feature could be usefull for others too. So I ask you to
include it in the next release, if it doesn't break something else.
Please CC for answers, I am not subscribed.
--
Georg
config.patch
(text/plain, 380 B)
--- /home/gal/progs/pc/moin-1.2.3/MoinMoin/config.py 2004-07-21 22:02:15.000000000 +0200
+++ config.py 2004-09-03 12:43:13.565993488 +0200
@@ -54,6 +54,7 @@
'allowed_actions': [],
'allow_xslt': 0,
'attachments': None, # {'dir': path, 'url': url-prefix}
+ 'attachments_maxsize': 2097152,
'auth_http_enabled': 0,
'bang_meta': 0,
'backtick_meta': 1,
attachfile.patch
(text/plain, 1003 B)
--- /home/gal/progs/pc/moin-1.2.3/MoinMoin/action/AttachFile.py 2004-07-21 22:02:15.000000000 +0200
+++ AttachFile.py 2004-09-03 14:44:43.902693848 +0200
@@ -334,7 +334,7 @@
'baseurl': request.getScriptname(),
'pagename': wikiutil.quoteWikiname(pagename),
'action_name': action_name,
- 'upload_label_file': _('File to upload'),
+ 'upload_label_file': _('File to upload(max. %s Bytes)') % (config.attachments_maxsize),
'upload_label_mime': _('MIME Type (optional)'),
'upload_label_rename': _('Save as'),
'rename': request.form.get('rename', [''])[0],
@@ -424,7 +424,11 @@
# get file content
filecontent = request.form['file'][0]
-
+
+ if len(filecontent)>config.attachments_maxsize:
+ error_msg(pagename,request, _("Your file has not been uploaded: The max. filesize on this site is %s Bytes") % (config.attachments_maxsize))
+ return
+
target = wikiutil.taintfilename(target)
# set mimetype from extension, or from given mimetype