summary refs log tree commit diff
path: root/synapse/http/content_repository.py
diff options
context:
space:
mode:
authorMark Haines <mark.haines@matrix.org>2014-09-03 17:04:00 +0100
committerMark Haines <mark.haines@matrix.org>2014-09-03 17:04:16 +0100
commitee2bcdec653edfc5316164f2a58bda64ed8b761f (patch)
tree0c88821530bc9f9124c6aa8f992e2cd42db1b757 /synapse/http/content_repository.py
parentBubble up SynapseErrors so expected failures aren't masked. (diff)
downloadsynapse-ee2bcdec653edfc5316164f2a58bda64ed8b761f.tar.xz
Limit the size of uploads
Diffstat (limited to 'synapse/http/content_repository.py')
-rw-r--r--synapse/http/content_repository.py14
1 files changed, 14 insertions, 0 deletions
diff --git a/synapse/http/content_repository.py b/synapse/http/content_repository.py
index 5f5cd9b9e0..6a80c5f2c1 100644
--- a/synapse/http/content_repository.py
+++ b/synapse/http/content_repository.py
@@ -56,6 +56,7 @@ class ContentRepoResource(resource.Resource):
         self.directory = directory
         self.auth = auth
         self.external_addr = external_addr.rstrip('/')
+        self.max_upload_size = hs.config.max_upload_size
 
         if not os.path.isdir(self.directory):
             os.mkdir(self.directory)
@@ -155,6 +156,19 @@ class ContentRepoResource(resource.Resource):
     @defer.inlineCallbacks
     def _async_render(self, request):
         try:
+            # TODO: The checks here are a bit late. The content will have
+            # already been uploaded to a tmp file at this point
+            content_length = request.getHeader("Content-Length")
+            if content_length is None:
+                raise SynapseError(
+                    msg="Request must specify a Content-Length", code=400
+                )
+            if int(content_length) > self.max_upload_size:
+                raise SynapseError(
+                    msg="Upload request body is too large",
+                    code=413,
+                )
+
             fname = yield self.map_request_to_name(request)
 
             # TODO I have a suspcious feeling this is just going to block