Skip to content
This repository was archived by the owner on Mar 4, 2025. It is now read-only.

Commit 2dfb72d

Browse files
justincliftjustinclift
committed
api, db4s, common, webui: Allow specific named users to exceed database upload limits
1 parent a20fdd7 commit 2dfb72d

File tree

6 files changed

+62
-34
lines changed

6 files changed

+62
-34
lines changed

‎api/handlers.go‎

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -665,16 +665,24 @@ func tagsHandler(w http.ResponseWriter, r *http.Request) {
665665
// should be appended to. For new databases it's not needed, but for existing databases it's required (its used to
666666
// detect out of date / conflicting uploads)
667667
func uploadHandler(w http.ResponseWriter, r *http.Request) {
668-
// Set the maximum accepted database size for uploading
669-
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
670-
671668
// Authenticate the request
672669
loggedInUser, err := checkAuth(w, r)
673670
if err != nil {
674671
jsonErr(w, err.Error(), http.StatusUnauthorized)
675672
return
676673
}
677674

675+
// Set the maximum accepted database size for uploading
676+
oversizeAllowed := false
677+
for _, user := range com.Conf.Environment.SizeOverrideUsers {
678+
if loggedInUser == user {
679+
oversizeAllowed = true
680+
}
681+
}
682+
if !oversizeAllowed {
683+
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
684+
}
685+
678686
// Extract the database name and (optional) commit ID for the database from the request
679687
_, dbName, commitID, err := com.GetFormODC(r)
680688
if err != nil {
@@ -691,14 +699,15 @@ func uploadHandler(w http.ResponseWriter, r *http.Request) {
691699
}
692700

693701
// Check whether the uploaded database is too large
694-
// TODO: Have a list of users (from the config.toml file) which don't have this check applied
695-
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
696-
jsonErr(w,
697-
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
698-
com.MaxDatabaseSize, r.ContentLength/1024/1024), http.StatusBadRequest)
699-
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
700-
loggedInUser, r.ContentLength/1024/1024, com.MaxDatabaseSize))
701-
return
702+
if !oversizeAllowed {
703+
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
704+
jsonErr(w,
705+
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
706+
com.MaxDatabaseSize, r.ContentLength/1024/1024), http.StatusBadRequest)
707+
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
708+
loggedInUser, r.ContentLength/1024/1024, com.MaxDatabaseSize))
709+
return
710+
}
702711
}
703712

704713
// Process the upload

‎common/sqlite.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -865,7 +865,7 @@ func SQLiteRunQueryDefensive(w http.ResponseWriter, r *http.Request, querySource
865865
var memUsed, memHighWater int64
866866
memUsed, memHighWater, dataRows, err = SQLiteRunQuery(sdb, querySource, query, false, false)
867867
if err != nil {
868-
log.Printf("Error when preparing statement by '%s' for database (%s%s%s): '%s'\n", SanitiseLogString(loggedInUser),
868+
log.Printf("Error when preparing statement by '%s' for database (%s%s%s): '%s'\n", SanitiseLogString(loggedInUser),
869869
SanitiseLogString(dbOwner), SanitiseLogString(dbFolder), SanitiseLogString(dbName), SanitiseLogString(err.Error()))
870870
return SQLiteRecordSet{}, err
871871
}

‎common/types.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,9 @@ type DiskCacheInfo struct {
133133
// EnvInfo holds information about the purpose of the running server. eg "is this a production, docker,
134134
// or development" instance?
135135
type EnvInfo struct {
136-
Environment string
137-
UserOverride string `toml:"user_override"`
136+
Environment string
137+
UserOverride string `toml:"user_override"`
138+
SizeOverrideUsers []string `toml:"size_override_users"` // List of users allowed to override the database upload size limits
138139
}
139140

140141
// EventProcessingInfo hold configuration for the event processing loop

‎db4s/main.go‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -784,7 +784,15 @@ func metadataGetHandler(w http.ResponseWriter, r *http.Request) {
784784
//
785785
func postHandler(w http.ResponseWriter, r *http.Request, userAcc string) {
786786
// Set the maximum accepted database size for uploading
787-
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
787+
oversizeAllowed := false
788+
for _, user := range com.Conf.Environment.SizeOverrideUsers {
789+
if userAcc == user {
790+
oversizeAllowed = true
791+
}
792+
}
793+
if !oversizeAllowed {
794+
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
795+
}
788796

789797
// The "public" user isn't allowed to make changes
790798
if userAcc == "public" {
@@ -812,14 +820,15 @@ func postHandler(w http.ResponseWriter, r *http.Request, userAcc string) {
812820
}
813821

814822
// Check whether the uploaded database is too large
815-
// TODO: Have a list of users (from the config.toml file) which don't have this check applied
816-
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
817-
http.Error(w,
818-
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
819-
com.MaxDatabaseSize, r.ContentLength/1024/1024), http.StatusBadRequest)
820-
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
821-
userAcc, r.ContentLength/1024/1024, com.MaxDatabaseSize))
822-
return
823+
if !oversizeAllowed {
824+
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
825+
http.Error(w,
826+
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
827+
com.MaxDatabaseSize, r.ContentLength/1024/1024), http.StatusBadRequest)
828+
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
829+
userAcc, r.ContentLength/1024/1024, com.MaxDatabaseSize))
830+
return
831+
}
823832
}
824833

825834
// Do the remaining input validation, and add the database to the system in the appropriate spot

‎docker/config.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ directory = "/home/dbhub/.dbhub/disk_cache"
1111
[environment]
1212
environment = "test"
1313
user_override = "default"
14+
size_override_users = ["default"]
1415

1516
[event]
1617
delay = 2

‎webui/main.go‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5165,9 +5165,6 @@ func uploadDataHandler(w http.ResponseWriter, r *http.Request) {
51655165
// TODO: Investigate getting the last modified timestamp of the database file selected for upload
51665166
// TODO * https://developer.mozilla.org/en-US/docs/Web/API/File/lastModified
51675167

5168-
// Set the maximum accepted database size for uploading
5169-
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
5170-
51715168
// Retrieve session data (if any)
51725169
loggedInUser, validSession, err := checkLogin(r)
51735170
if err != nil {
@@ -5181,14 +5178,25 @@ func uploadDataHandler(w http.ResponseWriter, r *http.Request) {
51815178
return
51825179
}
51835180

5184-
// Check whether the uploaded database is too large
5185-
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
5186-
errorPage(w, r, http.StatusBadRequest,
5187-
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
5188-
com.MaxDatabaseSize, r.ContentLength/1024/1024))
5189-
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
5190-
loggedInUser, r.ContentLength/1024/1024, com.MaxDatabaseSize))
5191-
return
5181+
// Set the maximum accepted database size for uploading
5182+
oversizeAllowed := false
5183+
for _, user := range com.Conf.Environment.SizeOverrideUsers {
5184+
if loggedInUser == user {
5185+
oversizeAllowed = true
5186+
}
5187+
}
5188+
if !oversizeAllowed {
5189+
r.Body = http.MaxBytesReader(w, r.Body, com.MaxDatabaseSize*1024*1024)
5190+
5191+
// Check whether the uploaded database is too large (except for specific users)
5192+
if r.ContentLength > (com.MaxDatabaseSize * 1024 * 1024) {
5193+
errorPage(w, r, http.StatusBadRequest,
5194+
fmt.Sprintf("Database is too large. Maximum database upload size is %d MB, yours is %d MB",
5195+
com.MaxDatabaseSize, r.ContentLength/1024/1024))
5196+
log.Println(fmt.Sprintf("'%s' attempted to upload an oversized database %d MB in size. Limit is %d MB\n",
5197+
loggedInUser, r.ContentLength/1024/1024, com.MaxDatabaseSize))
5198+
return
5199+
}
51925200
}
51935201

51945202
// Prepare the form data

0 commit comments

Comments
 (0)