diff options
| -rwxr-xr-x | LedgerSMB/Form.pm | 5 | ||||
| -rwxr-xr-x | admin.pl | 7 | ||||
| -rw-r--r-- | ledgersmb.conf.default | 3 |
3 files changed, 14 insertions, 1 deletions
diff --git a/LedgerSMB/Form.pm b/LedgerSMB/Form.pm index 6cb65964..e37de58a 100755 --- a/LedgerSMB/Form.pm +++ b/LedgerSMB/Form.pm @@ -52,6 +52,11 @@ sub new { my $argstr = shift; + if ($ENV{CONTENT_LENGTH} > $LedgerSMB::Sysconfig::max_post_size) { + print "Status: 413\n Request entity too large\n\n"; + die "Error: Request entity too large\n"; + } + read( STDIN, $_, $ENV{CONTENT_LENGTH} ); if ($argstr) { @@ -53,7 +53,12 @@ require "common.pl"; $| = 1; -if ( $ENV{CONTENT_LENGTH} ) { +if ( $ENV{CONTENT_LENGTH} > $LedgerSMB::Sysconfig::max_post_size ) { + print "Status: 413\n Request entity too large\n\n"; + die "Error: Request entity too large\n"; +} + +if ( $ENV{CONTENT_LENGTH} > 0 ) { read( STDIN, $_, $ENV{CONTENT_LENGTH} ); } diff --git a/ledgersmb.conf.default b/ledgersmb.conf.default index 6b45ce44..482f7f65 100644 --- a/ledgersmb.conf.default +++ b/ledgersmb.conf.default @@ -10,6 +10,9 @@ latex : 1 # Maximum number of invoices that can be printed on a cheque check_max_invoices : 5 +# Maximum POST size to prevent DoS (4MB default) +max_post_size : 4194304 + [environment] # If the server can't find applications, append to the path PATH: /usr/local/pgsql/bin |