Django

Code

Changeset 3805

Show
Ignore:
Timestamp:
09/23/06 07:41:19 (2 years ago)
Author:
mtredinnick
Message:

Fixed #2613 -- Fixed an easily triggered memory error in file uploads for WSGI.
Thanks Jeong-Min Lee.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/trunk/AUTHORS

    r3800 r3805  
    101101    Stuart Langridge <http://www.kryogenix.org/> 
    102102    Eugene Lazutkin <http://lazutkin.com/blog/> 
     103    Jeong-Min Lee 
    103104    Christopher Lenz <http://www.cmlenz.net/> 
    104105    limodou 

  • django/trunk/django/core/handlers/wsgi.py

    r3791 r3805  
    55from django import http 
    66from pprint import pformat 
     7from shutil import copyfileobj 
     8try: 
     9    from cStringIO import StringIO 
     10except ImportError: 
     11    from StringIO import StringIO 
    712 
    813# See http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html 
    …… 
    5055    505: 'HTTP VERSION NOT SUPPORTED', 
    5156} 
     57 
     58def safe_copyfileobj(fsrc, fdst, length=16*1024, size=0): 
     59    """ 
     60    A version of shutil.copyfileobj that will not read more than 'size' bytes. 
     61    This makes it safe from clients sending more than CONTENT_LENGTH bytes of 
     62    data in the body. 
     63    """ 
     64    if not size: 
     65        return copyfileobj(fsrc, fdst, length) 
     66    while size > 0: 
     67        buf = fsrc.read(min(length, remain)) 
     68        if not buf: 
     69            break 
     70        fdst.write(buf) 
     71        size -= len(buf) 
    5272 
    5373class WSGIRequest(http.HttpRequest): 
    …… 
    120140            return self._raw_post_data 
    121141        except AttributeError: 
    122             self._raw_post_data = self.environ['wsgi.input'].read(int(self.environ["CONTENT_LENGTH"])) 
     142            buf = StringIO() 
     143            content_length = int(self.environ['CONTENT_LENGTH']) 
     144            safe_copyfileobj(self.environ['wsgi.input'], buf, size=content_length) 
     145            self._raw_post_data = buf.getvalue() 
     146            buf.close() 
    123147            return self._raw_post_data 
    124148