CONTENT_LENGTH is a user supplied variable. Without any checks for size, one could easily DoS the machine with very large POSTS

git-svn-id: https://ledger-smb.svn.sourceforge.net/svnroot/ledger-smb/trunk@2196 4979c152-3d1c-0410-bac9-87ea11338e46

3 files changed, 14 insertions, 1 deletions

diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm
index cb938c8d..b8cd8f70 100644
--- a/LedgerSMB/Form.pm
+++ b/LedgerSMB/Form.pm
@@ -89,6 +89,11 @@ sub new {
 
     my $argstr = shift;
 
+    if ($ENV{CONTENT_LENGTH} > $LedgerSMB::Sysconfig::max_post_size; ) {
+        print "Status: 413\n Request entity too large\n\n";
+        die "Error: Request entity too large\n";
+    }
+
     read( STDIN, $_, $ENV{CONTENT_LENGTH} );
 
     if ($argstr) {
diff --git a/admin.pl b/admin.pl
index c4ae2d48..3e63e4e9 100755
--- a/admin.pl
+++ b/admin.pl
@@ -53,7 +53,12 @@ require "common.pl";
 
 $| = 1;
 
-if ( $ENV{CONTENT_LENGTH} ) {
+if ($ENV{CONTENT_LENGTH} > $LedgerSMB::Sysconfig::max_post_size; ) {
+    print "Status: 413\n Request entity too large\n\n";
+    die "Error: Request entity too large\n";
+}
+
+if ( $ENV{CONTENT_LENGTH} > 0 ) {
     read( STDIN, $_, $ENV{CONTENT_LENGTH} );
 }
 
diff --git a/ledgersmb.conf.default b/ledgersmb.conf.default
index 4fd3d54c..0090042e 100644
--- a/ledgersmb.conf.default
+++ b/ledgersmb.conf.default
@@ -10,6 +10,9 @@ latex : 1
 # Maximum number of invoices that can be printed on a cheque
 check_max_invoices : 5
 
+# Maximum POST size to prevent DoS (4MB default)
+max_form_size : 4194304
+
 [environment]
 # If the server can't find applications, append to the path
 PATH: /usr/local/pgsql/bin