diff options
| author | Kim Alvefur <zash@zash.se> | 2021-01-27 17:47:04 +0100 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2021-01-27 17:47:04 +0100 |
| commit | e4a97b8e7adc69cce1d3583139d55ff92eec24cd (patch) | |
| tree | 2c8c3e59226a3cbe62c36959b5d4db836f862c40 /plugins | |
| parent | 93494930ea014c8b478089faec609798e50d4780 (diff) | |
| download | prosody-e4a97b8e7adc69cce1d3583139d55ff92eec24cd.tar.gz prosody-e4a97b8e7adc69cce1d3583139d55ff92eec24cd.zip | |
mod_http_file_share: Validate file size early in HTTP PUT request
Diffstat (limited to 'plugins')
| -rw-r--r-- | plugins/mod_http_file_share.lua | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index ca835727..25efdaa8 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -165,6 +165,11 @@ function handle_upload(event, path) -- PUT /upload/:slot module:log("debug", "Invalid upload slot: %q, path: %q", upload_info.slot, path); return 400; end + if request.headers.content_length and tonumber(request.headers.content_length) ~= upload_info.filesize then + return 413; + -- Note: We don't know the size if the upload is streamed in chunked encoding, + -- so we also check the final file size on completion. + end local filename = dm.getpath(upload_info.slot, module.host, module.name, nil, true); |