Forum OpenACS Q&A: Limiting Filesize via html form file upload

Hi there,

I am building my site which permits users to upload smaller files and have a question about file upload via html form.

Is there a way to limit a file size before the client actually finished the upload? I would like to be able to handle the case when users accidentally (or intensionally) choosing a file which is too big to upload.

Let's say If I want to limit the size to 2M, I believe I don't have to wait until the 20M+ client upload (prohibited) finished in order to check the file size, right?

Thank you in advance.

Sincerely,

I would also be interested in such a solution.

But what exactly do you mean with ns_conncptofp? There is no such call in OpenACS...

Hey,

Thank you for your hints, Jerry.

Now I gotta answer my own question. It's a less-than-decent solution.

The saver is [ns_conn contentlength] which checks the http header of the http request. Code fraqments for the form action:

     

################### begin of code     

# check security here if needed     

set content_length [ns_conn contentlength]     

if {$content_length > 1457664} {     

   # upload is more than 1M, reject     

   ns_returnredirect "error_page"   

   return   

}      

# now that we checked the request is permitted,      

# actually parse the data     

set_the_usual_form_variables     

# do some insert / logic / file handling, blah...     

###############end of code     

The key is to do the ns_conn before [set_the_usual_form_variables] because [set_the_usual...] calls ns_getform to actually parse the data. I call this a less-than-decent solution because this check the content-length of the whole client request but not the upload file alone. The size of the whole client request consists of other form data and some other stuffs.

For me I am just giving a few hundred kilobytes on top of the upload file size limit to handle the extras.

For a decent solution (check the file size alone) one would want to edit form.tcl/ns_getform in the Aolserver modules.

Thanks again.

Sincerely,

I don't think you need to worry about your second DoS suggestion.  AOLserver has pretty reasonable limits (configurable of course) for the maxline (8K bytes), maxheader (16Kbytes), and maxpost (64Kbytes for all except POSTed multipart/formdata (file uploads that is)).

Examining the code, while it doesn't appear that AOLserver will drop the connection, after the first maxheader bytes, it won't read any more from the connection unless it's a POST.  If it's a POST, it is required to have a contentlength (for HTTP/1.0 servers).  If it's not multipart/form-data, the post must be under maxpost bytes.  If it is a file upload, then your check will nuke it if it's over 2M.  I think.

More information on my queston:

I tried using Netscape test my HTML form that uploads a file using the file storage package. But after a while an error message "connection reset by peer" pops up and connection dropped.

Because I use nsunix/ nsvhr, I try again by giving the port no (8000) and this time it works! Any suggestion to this strange behaviour?

Thanks.

How I limit the file size via html form file upload.Give some examples also.