From 3ab51f686468eac1693b611d0526b20fed6bcd6e Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Wed, 27 Jan 2021 00:36:49 +0100 Subject: mod_http_file_share: Reject invalid file sizes --- plugins/mod_http_file_share.lua | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'plugins') diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index 8a47b824..8d3310c9 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -48,6 +48,7 @@ local upload_errors = errors.init(module.name, namespace, { filetype = { type = "modify"; condition = "not-acceptable"; text = "File type not allowed" }; filesize = { type = "modify"; condition = "not-acceptable"; text = "File too large"; extra = {tag = st.stanza("file-too-large", {xmlns = namespace}):tag("max-file-size"):text(tostring(file_size_limit)) }; + filesizefmt = { type = "modify"; condition = "bad-request"; text = "File size must be positive integer"; } }; }); @@ -62,6 +63,9 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error return false, upload_errors.new("filename"); end + if not filesize or filesize < 0 or filesize % 1 ~= 0 then + return false, upload_errors.new("filesizefmt"); + end if filesize > file_size_limit then return false, upload_errors.new("filesize"); end -- cgit v1.2.3