RE: [webmin-l] Restricting file upload size

[Dave I. <dav...@en...>]

My experience shows that this does not work.

I put a 1000000 limit in my call to ReadParseMime then attempted to upload a
1GB file.  Using top, I watched the miniserv.pl process climb to about 600MB
before crashing.  ReadParseMime was never called because my module was never
invoked.

If I look at miniserv.pl, at around line 1740, I see

	$clen = $header{"content-length"};
	if ($method eq "POST" && $clen_read < $clen) {
		# Still some more POST data to read
		while(length($postinput) < $clen) {
			$buf = &read_data($clen - length($postinput));
			if (!length($buf)) {
				&http_error(500, "Failed to read ".
						 "POST request");
				}
			$postinput .= $buf;
			}
		}

This looks an awful lot like reading in the entire file upload.  As a test,
I wrote the length($postinput) value to a log file (right before the call to
read_data) and found that miniserv.pl was looping in an attempt to read the
entire file upload.

Then I stumbled upon the forkcgis configuration setting, which appears to
switch on a alternative method of invoking the webmin modules.  This method
has miniserv.pl forwarding the file upload to the forked process as it is
received.  Unfortunately, this does not work either.  Now when I upload a
large file, something goes wrong and there is never a response.  The log
messages I put in the miniserv loop shows that about 7500 bytes are read in,
and then everything stops.  Although this is better than crashing the
server, it is still not correct.

Thanks

Dave I



-----Original Message-----
From: web...@li...
[mailto:web...@li...] On Behalf Of Jamie
Cameron
Sent: Friday, February 10, 2006 4:06 AM
To: web...@li...
Subject: Re: [webmin-l] Restricting file upload size


Hi Dave,
In your custom module, you can pass a parameter to the ReadParseMime
function to limit uploads to a specified number of bytes. This is the only
function that actually reads the upload into memory - the main miniserv.pl
process does not.

 - Jamie

-----Original Message-----

From:  Dave Isaacs <dav...@en...>
Subj:  [webmin-l] Restricting file upload size
Date:  Fri 10 Feb 2006 2:37 am
Size:  1K
To:  "'web...@li...'"
<web...@li...>

     Restricting file upload size
    Is there any way to have miniserv reject file uploads over a certain
size? 
  I have implemented a custom module that allows users to upload an image
file. However, if the user attempts to upload a very large file (say 1GB),
the whole server grinds to a halt as miniserv attempts to load the file into
memory.
  I can put size restrictions in my module, but miniserv still attempts to
upload the entire file before passing control to my module. What I need to
happen is for miniserv to reject the upload immediately (perhaps with Error
413 - Request Entity Too Large), without uploading anything.
  Thanks 
  Dave Isaacs 
     --- message truncated --- 



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list