Limiting uploaded file size onto a web server
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
alex256 · 2017-07-23 19:35

Hello. I am wondering how to limit the size of file that is uploaded
onto a web server (which is made using THTTPApplication)?

----------------------------------------------------------------------
Thaddy · 2017-07-23 19:53

Quote from: alex256 on July 23, 2017, 09:35:21 pmHello. I am wondering
how to limit the size of file that is uploaded onto a web server
(which is made using THTTPApplication)?
Keep account of buffers received...Disconnect....

----------------------------------------------------------------------
alex256 · 2017-07-23 19:56

Quote from: Thaddy on July 23, 2017, 09:53:02 pmQuote from: alex256 on
July 23, 2017, 09:35:21 pmHello. I am wondering how to limit the size
of file that is uploaded onto a web server (which is made using
THTTPApplication)?
Keep account of buffers received...Disconnect....

Thanks, but how to do this?

----------------------------------------------------------------------
Leledumbo · 2017-07-24 04:17

Quick glance at the code, there's no way to do that BEFORE accepting
the whole multipart stream. Handle if afterwards instead, see
TUploadedFile class members for inspiration.

----------------------------------------------------------------------
alex256 · 2017-07-24 09:51

So, there is no way to do this without uploading the file to the
server?

----------------------------------------------------------------------
Thaddy · 2017-07-24 10:05

Quote from: Leledumbo on July 24, 2017, 06:17:11 amQuick glance at the
code, there's no way to do that BEFORE accepting the whole multipart
stream. Handle if afterwards instead, see TUploadedFile class members
for inspiration.

What? Did you look at the inheritance? Socket level? Of course you can
do that....

If the receiving socket receives too much, you quit. It is the socket
that has to count.... not a higher level....

----------------------------------------------------------------------
Leledumbo · 2017-07-24 10:13

Quote from: alex256 on July 24, 2017, 11:51:25 amSo, there is no way
to do this without uploading the file to the server? 
Well of course there is, by subclassing the relevant class(es) and
handle that at the point you want. Somewhere in
TRequest.ProcessMultiPart or TMimeItems.FormSplit. Normally we can
only limit the whole request size (using web server feature in case of
3rd party) instead of just one field, because multipart data has no
explicit size for each field (but can be calculated from boundary).

----------------------------------------------------------------------
alex256 · 2017-07-24 12:41

Thank you very much, I will try

----------------------------------------------------------------------
alex256 · 2017-07-24 16:26

Finally I got to make it work. I overloaded
TMimeItems.CreateUploadFiles not to allow big files. But in
TMimeItems.CreateUploadFiles they are already loaded into the memory.
So I also added the request size limit inheriting many classes and
overriding creation methods. The code is:

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i unit
mycusthttp; {$mode objfpc}{$H+} interface uses  Classes, custhttpapp,
HTTPDefs, fphttp, fphttpserver, custweb, ssockets; type   {
TMyMimeItems }   TMyMimeItems = class(TMimeItems)  public    procedure
CreateUploadFiles(Files: TUploadedFiles; Vars: TStrings); override; 
end;   { TMyHTTPConnection }   TMyHTTPConnection =
class(TFPHTTPConnection)  protected    procedure
ReadRequestContent(ARequest: TFPHTTPConnectionRequest); override; 
end;   { TMyHttpServer }   TMyHttpServer = class(TEmbeddedHttpServer) 
protected    function CreateConnection(Data: TSocketStream):
TFPHTTPConnection; override;  end;   { TMyHTTPServerHandler }  
TMyHTTPServerHandler = class(TFPHTTPServerHandler)  protected   
function CreateServer: TEmbeddedHttpServer; override;  end;   {
TMyCustomHTTPApplication }   TMyCustomHTTPApplication =
class(TCustomHTTPApplication)  protected    function
InitializeWebHandler: TWebHandler; override;  end; implementation {
TMyMimeItems } procedure TMyMimeItems.CreateUploadFiles(Files:
TUploadedFiles; Vars: TStrings);var  I: integer;begin  for I := 0 to
Count - 1 do  begin    if (Items[I] as TMimeItem).DataSize > 1024
then    begin      Vars.Add('success=false');      Exit;    end; 
end;  Vars.Add('success=true');  inherited CreateUploadFiles(Files,
Vars);end; { TMyHTTPConnection } procedure
TMyHTTPConnection.ReadRequestContent(ARequest:
TFPHTTPConnectionRequest);var  L: integer;begin  L :=
ARequest.ContentLength;  if L > 65536 then    raise
EFPHTTPError.Create('Request too big!');  inherited
ReadRequestContent(ARequest);end; { TMyHttpServer } function
TMyHttpServer.CreateConnection(Data: TSocketStream):
TFPHTTPConnection;begin  Result := TMyHTTPConnection.Create(Self,
Data);end; { TMyHTTPServerHandler } function
TMyHTTPServerHandler.CreateServer: TEmbeddedHttpServer;begin  Result
:= TMyHttpServer.Create(Self);end; { TMyCustomHTTPApplication
} function TMyCustomHTTPApplication.InitializeWebHandler:
TWebHandler;begin  Result :=
TMyHTTPServerHandler.Create(Self);end; initialization  MimeItemsClass
:= TMyMimeItems; end.

----------------------------------------------------------------------
Blestan · 2017-07-24 20:31

keep in mind that you cannot control how many bytes the client will
send and most of the browsers and http libs will not check the socket
state when sendind so even you close the socket gracefuly with
shutdown the clent will hang by timeout