diff options
| author | Kim Alvefur <zash@zash.se> | 2021-01-27 17:47:04 +0100 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2021-01-27 17:47:04 +0100 |
| commit | 77e9e9eaa6da66591fe7b8e4da9378ead6439629 (patch) | |
| tree | 2c8c3e59226a3cbe62c36959b5d4db836f862c40 | |
| parent | 02595598b0eeb9cb6c39046c11a442121c8e9886 (diff) | |
| download | prosody-77e9e9eaa6da66591fe7b8e4da9378ead6439629.tar.gz prosody-77e9e9eaa6da66591fe7b8e4da9378ead6439629.zip | |
mod_http_file_share: Validate file size early in HTTP PUT request
| -rw-r--r-- | plugins/mod_http_file_share.lua | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index ca835727..25efdaa8 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -165,6 +165,11 @@ function handle_upload(event, path) -- PUT /upload/:slot module:log("debug", "Invalid upload slot: %q, path: %q", upload_info.slot, path); return 400; end + if request.headers.content_length and tonumber(request.headers.content_length) ~= upload_info.filesize then + return 413; + -- Note: We don't know the size if the upload is streamed in chunked encoding, + -- so we also check the final file size on completion. + end local filename = dm.getpath(upload_info.slot, module.host, module.name, nil, true); |