Implemented: Limit size of attached files

TWiki supports now a size limit for attached files. The limit can be set in a ATTACHFILESIZELIMIT TWikiPreferences variable.

To upgrade your installation apply these changes:

RCS file: /cvsroot/twiki/twiki/bin/upload,v
retrieving revision 1.46
diff -c -r1.46 upload
*** upload      26 Oct 2003 01:22:18 -0000      1.46
--- upload      26 Dec 2003 03:07:37 -0000
***************
*** 385,396 ****

      my( $fileSize, $fileUser, $fileDate, $fileVersion ) = "";

!     if( ! $doChangeProperties ) {
        # check if file exists and has non zero size
        my $size = -s $tmpFilename;
        if( ! -e $tmpFilename || ! $size ) {
            handleError( $noredirect, "File missing or zero size",
                   $query, $webName, $topic, "oopsupload", $fileName );
            return;
        }

--- 385,406 ----

      my( $fileSize, $fileUser, $fileDate, $fileVersion ) = "";

!     unless( $doChangeProperties ) {
        # check if file exists and has non zero size
        my $size = -s $tmpFilename;
+
        if( ! -e $tmpFilename || ! $size ) {
            handleError( $noredirect, "File missing or zero size",
                   $query, $webName, $topic, "oopsupload", $fileName );
+           return;
+       }
+
+         my $maxSize = &TWiki::Prefs::getPreferencesValue( "ATTACHFILESIZELIMIT" );
+         $maxSize =~ /([0-9]+)/;
+         $maxSize = $1 || 0;
+       if( $maxSize && $size > $maxSize * 1024 ) {
+           handleError( $noredirect, "File exceeds size limit",
+                  $query, $webName, $topic, "oopsuploadlimit", $fileName, $maxSize );
            return;
        }

Add file oopsuploadlimit.tmpl to twiki/templates:

%TMPL:INCLUDE{"twiki"}%
%TMPL:DEF{"titleaction"}%(oops)%TMPL:END%
%TMPL:DEF{"webaction"}% *Attention* %TMPL:END%
%TMPL:DEF{"heading"}%Uploaded file is too big%TMPL:END%
%TMPL:DEF{"message"}%
Uploaded file <code>%PARAM1%</code> exceeds limit of %PARAM2% KB
%TMPL:END%
%TMPL:DEF{"topicaction"}% [[%WEB%.%TOPIC%][OK]] %TMPL:END%
%TMPL:P{"oops"}%

Add this to your TWiki.TWikiPreferences:

   * Maximum size of %TWIKIWEB%.FileAttachments in KB, 0 for no limit:
      * Set ATTACHFILESIZELIMIT = 500

Change is in TWikiAlphaRelease and at TWiki.org.

-- PeterThoeny - 26 Dec 2003

This feature fits the TWikiMission in supporting an IT policy limiting the size of attachments.

I added this little feature to reduce my time maintaining the TWiki.org website. Frequently people upload large files to the Main web and Sandbox web. I set the limit to 50 KB for those webs. The Codev, Plugins and Support webs have a much higher limit (100000 KB for Codev web). Let us know in case this limit is not high enough.

-- PeterThoeny - 26 Dec 2003

A generic version of this functionality can be found at BeforeAttachmentSaveHandler. That allows any plugin to intervene in the upload of an attachment. There exists also on that page an example plugin that uses Image Magick to resize an uploaded picture. Another plugin could just veto the upload of attachments that are too big.

-- MartinCleaver - 26 Dec 2003

I don't think this would necessarily solve LargeAttachmentsBreakTWiki, where an upload was actually larger than the free space on the file system, since CGI.pm will still upload the entire attachment to a temporary directory, but it would make it somewhat less likely.

There is a specific $CGI::POST_MAX variable in CPAN:CGI that would prevent large uploads from even hitting the temporary directory - might be better to use that.

-- RichardDonkin - 28 Dec 2003

I agree Richard, it would not solve LargeAttachmentsBreakTWiki - for that the $CGI::POST_MAX variable would be better. But it would have had the effect of reducing Peter's time maintaining the TWiki.org website.

-- MartinCleaver - 28 Dec 2003

If I do not set the limit in TWikiPreferences the statement $maxSize =~ /([0-9]+)/; does not match and so $maxSize = $1 || 0; sets $maxSize to the result of the last match $tmpFilename =~ /(.*)/; some lines before. The effect is getting unpredictable results. It should be easy to implement this feature stable also in the case the variable is not defined.

-- LarsWith - 16 Mar 2004

Thanks for reporting this, a good example of "Given enough eyeballs, all bugs are shallow".

It has already been fixed a few weeks back to:

    my $maxSize = &TWiki::Prefs::getPreferencesValue( "ATTACHFILESIZELIMIT" );
    $maxSize = 0 unless $maxSize =~ /([0-9]+)/;

-- PeterThoeny - 17 Mar 2004

What determines whteher settings like this should set by configure instead of on Main.TWikiPreferences?

-- MartinCleaver - 28 Feb 2006

Legacy? This is the kind of setting that needed to be maintained "online", and the only mechanism was to put it in TWikiPreferences.

Of course, all the current TWikiPreferences setting could go into configure, but that means that a new, more ergonomic interface would be needed.

-- RafaelAlvarez - 28 Feb 2006

I guess one thing that could be a criteria, is if the setting could vary pr. web / topic (as this one). If it's not "site-centric", then it should probably not go into configure.

-- SteffenPoulsen - 28 Feb 2006