aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2021-01-27 17:47:04 +0100
committerKim Alvefur <zash@zash.se>2021-01-27 17:47:04 +0100
commite4a97b8e7adc69cce1d3583139d55ff92eec24cd (patch)
tree2c8c3e59226a3cbe62c36959b5d4db836f862c40 /plugins
parent93494930ea014c8b478089faec609798e50d4780 (diff)
downloadprosody-e4a97b8e7adc69cce1d3583139d55ff92eec24cd.tar.gz
prosody-e4a97b8e7adc69cce1d3583139d55ff92eec24cd.zip
mod_http_file_share: Validate file size early in HTTP PUT request
Diffstat (limited to 'plugins')
-rw-r--r--plugins/mod_http_file_share.lua5
1 files changed, 5 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index ca835727..25efdaa8 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -165,6 +165,11 @@ function handle_upload(event, path) -- PUT /upload/:slot
module:log("debug", "Invalid upload slot: %q, path: %q", upload_info.slot, path);
return 400;
end
+ if request.headers.content_length and tonumber(request.headers.content_length) ~= upload_info.filesize then
+ return 413;
+ -- Note: We don't know the size if the upload is streamed in chunked encoding,
+ -- so we also check the final file size on completion.
+ end
local filename = dm.getpath(upload_info.slot, module.host, module.name, nil, true);