From 987976f20f4428af0981d69c3afda0047f4bea5e Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Wed, 27 Jan 2021 00:09:49 +0100 Subject: mod_http_file_share: Verify final file size on completion of upload --- plugins/mod_http_file_share.lua | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index a4ac4693..ef427b94 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -173,7 +173,12 @@ function handle_upload(event, path) -- PUT /upload/:slot end if request.body_sink then + local final_size = request.body_sink:seek(); local uploaded, err = errors.coerce(request.body_sink:close()); + if final_size ~= upload_info.filesize then + -- Could be too short as well, but we say the same thing + uploaded, err = false, 413; + end if uploaded then assert(os.rename(filename.."~", filename)); return 201; -- cgit v1.2.3