mod_http_file_share: Reject invalid file sizes

1 files changed, 4 insertions, 0 deletions

diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index 8a47b824..8d3310c9 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -48,6 +48,7 @@ local upload_errors = errors.init(module.name, namespace, {
 	filetype = { type = "modify"; condition = "not-acceptable"; text = "File type not allowed" };
 	filesize = { type = "modify"; condition = "not-acceptable"; text = "File too large";
 		extra = {tag = st.stanza("file-too-large", {xmlns = namespace}):tag("max-file-size"):text(tostring(file_size_limit)) };
+	filesizefmt = { type = "modify"; condition = "bad-request"; text = "File size must be positive integer"; }
 	};
 });
 
@@ -62,6 +63,9 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
 		return false, upload_errors.new("filename");
 	end
 
+	if not filesize or filesize < 0 or filesize % 1 ~= 0 then
+		return false, upload_errors.new("filesizefmt");
+	end
 	if filesize > file_size_limit then
 		return false, upload_errors.new("filesize");
 	end