| Key: |
MODPYTHON-40
|
| Type: |
Bug
|
| Status: |
Closed
|
| Resolution: |
Fixed
|
| Priority: |
Major
|
| Assignee: |
Unassigned
|
| Reporter: |
Nicolas Lehuen
|
| Votes: |
0
|
| Watchers: |
0
|
|
If you were logged in you would be able to see more operations.
|
|
|
| Resolution Date: |
13/Nov/05 02:13 AM
|
|
In mod_python.py/util.py, line 169, we stream a file upload to disk only if its Content-Disposition header features a filename attribute. Otherwise, the file is streamed to memory, thus opening a potential DoS attack by uploading very large files.
We should :
1) Always stream file upload to disk
2) Define a default maximum file size which could be overridable.
3) Allow for the user to specify in which directory file uploads should be made, with a default to a temporary directory / file.
|
|
Description
|
In mod_python.py/util.py, line 169, we stream a file upload to disk only if its Content-Disposition header features a filename attribute. Otherwise, the file is streamed to memory, thus opening a potential DoS attack by uploading very large files.
We should :
1) Always stream file upload to disk
2) Define a default maximum file size which could be overridable.
3) Allow for the user to specify in which directory file uploads should be made, with a default to a temporary directory / file.
|
Show » |
made changes - 06/Apr/05 03:25 PM
| Field |
Original Value |
New Value |
|
Status
|
Open
[ 1
]
|
Resolved
[ 5
]
|
|
Resolution
|
|
Fixed
[ 1
]
|
|
Fix Version/s
|
|
3.2.0
[ 11060
]
|
made changes - 07/Nov/05 04:41 PM
|
Resolution
|
Fixed
[ 1
]
|
|
|
Status
|
Resolved
[ 5
]
|
Reopened
[ 4
]
|
made changes - 13/Nov/05 02:13 AM
|
Status
|
Reopened
[ 4
]
|
Resolved
[ 5
]
|
|
Resolution
|
|
Fixed
[ 1
]
|
made changes - 05/Mar/06 01:49 PM
|
Status
|
Resolved
[ 5
]
|
Closed
[ 6
]
|
|
FieldStorage : don't stream file uploads to memory
