groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 11:41:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Refactored size checks for attachments and check base64 upload length

Browse source
This commit is contained in:
Jan Böhmer 2026-07-09 19:33:11 +02:00
parent a356b94c34
commit 76a36386fc
5 changed files with 33 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

36
src/Services/Attachments/AttachmentSubmitHandler.php
View file

@ -218,6 +218,14 @@ class AttachmentSubmitHandler
//If no file was uploaded, but we have base64 encoded data, create a file from it
if (!$file && $upload->data !== null) {
if (strlen($upload->data) > $this->getMaximumUserConfiguredUploadSize() * 4 / 3) { //Base64 encoding increases the size of the data by 4/3, so we have to check for that
throw new RuntimeException(
sprintf(
'The given base64 data is too big! Maximum size is %.1f MB!',
$this->getMaximumUserConfiguredUploadSize() / 1000 / 1000
));
}
$file = new UploadedBase64EncodedFile(new Base64EncodedFile($upload->data), $upload->filename ?? 'base64');
}
@ -226,6 +234,15 @@ class AttachmentSubmitHandler
//When a file is given then upload it, otherwise check if we need to download the URL
if ($file instanceof UploadedFile) {
//Check the file size, to avoid uploading too big files.
//The file is not necessarily validated as it can also come from an Base64 source
if ($file->getSize() > $this->getMaximumUserConfiguredUploadSize()) {
throw new RuntimeException(
sprintf(
'The uploaded file is too big! Maximum size is %.1f MB!',
$this->getMaximumUserConfiguredUploadSize() / 1000 / 1000
));
}
$this->upload($attachment, $file, $secure_attachment);
} elseif ($upload->downloadUrl && $attachment->hasExternal()) {
@ -402,7 +419,7 @@ class AttachmentSubmitHandler
$fileHandler = fopen($tmp_path, 'wb');
$bytesDownloaded = 0;
$maxSize = $this->attachmentsSettings->getMaxFileSizeInMegabytes() * 1024 * 1024; //Convert to bytes
$maxSize = $this->getMaximumUserConfiguredUploadSize(); //We use the maximum user configured size here, PHPs limits dont apply
//Write the downloaded data to file
foreach ($this->httpClient->stream($response) as $chunk) {
@ -418,8 +435,8 @@ class AttachmentSubmitHandler
throw new AttachmentDownloadException(
sprintf(
'The downloaded file is too big! Maximum size is %d MB!',
$this->settings->getMaxFileSizeInMegabytes()
'The downloaded file is too big! Maximum size is %.1f MB!',
$maxSize / 1000 / 1000
));
}
@ -527,10 +544,10 @@ class AttachmentSubmitHandler
}
/*
* Returns the maximum allowed upload size in bytes.
* Returns the maximum effective upload size in bytes.
* This is the minimum value of Part-DB max_file_size, and php.ini's post_max_size and upload_max_filesize.
*/
public function getMaximumAllowedUploadSize(): int
public function getMaximumEffectiveUploadSize(): int
{
if ($this->max_upload_size_bytes) {
return $this->max_upload_size_bytes;
@ -545,6 +562,15 @@ class AttachmentSubmitHandler
return $this->max_upload_size_bytes;
}
/**
* Returns the maximum user configured upload size in bytes.
* @return int
*/
public function getMaximumUserConfiguredUploadSize(): int
{
return $this->parseFileSizeString($this->settings->maxFileSize);
}
/**
* Sanitizes the given SVG file, if the attachment is an internal SVG file.
* @param Attachment $attachment