From e520aabc43138da56d16e555e9491843179e63b7 Mon Sep 17 00:00:00 2001 From: qsm-odoo Date: Tue, 26 Sep 2017 13:18:30 +0200 Subject: [PATCH] [FIX] website_slides: allow upload of >20MB files (as limit is 25MB) There is a double-check (on client and on server) to prevent the user to upload a >25 MB document. The client checks the actual file size while the server guesses it from the total received payload. This server guess is wrong as the extra payload is quite huge (5-10MB). Now the server checks the real file size as it should have from the beginning. --- addons/website_slides/controllers/main.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py index 2e0091b53f1..70f83b18a37 100644 --- a/addons/website_slides/controllers/main.py +++ b/addons/website_slides/controllers/main.py @@ -292,10 +292,8 @@ class website_slides(http.Controller): @http.route(['/slides/add_slide'], type='json', auth='user', methods=['POST'], website=True) def create_slide(self, *args, **post): - payload = request.httprequest.content_length - # payload is total request content size so it's not exact size of file. - # already add client validation this is for double check if client alter. - if (payload / 1024 / 1024 > 25): + file_size = len(post['datas']) * 3 / 4; # base64 + if (file_size / 1024.0 / 1024.0) > 25: return {'error': _('File is too big. File size cannot exceed 25MB')} values = dict((fname, post[fname]) for fname in [