Merge branch 'feature/upload-limits' into 'develop'

configurable media upload limits

Closes #118

See merge request pleroma/pleroma!401

config/config.exs

@@ -85,6 +85,9 @@
   description: "A Pleroma instance, an alternative fediverse server",
   limit: 5000,
   upload_limit: 16_000_000,
+  avatar_upload_limit: 2_000_000,
+  background_upload_limit: 4_000_000,
+  banner_upload_limit: 4_000_000,
   registrations_open: true,
   federating: true,
   allow_relay: true,

lib/pleroma/upload.ex

@@ -4,12 +4,21 @@ defmodule Pleroma.Upload do
   @storage_backend Application.get_env(:pleroma, Pleroma.Upload)
                    |> Keyword.fetch!(:uploader)
 
-  def store(%Plug.Upload{} = file, should_dedupe) do
+  def check_file_size(path, nil), do: true
+
+  def check_file_size(path, size_limit) do
+    {:ok, %{size: size}} = File.stat(path)
+    size <= size_limit
+  end
+
+  def store(file, should_dedupe, size_limit \\ nil)
+
+  def store(%Plug.Upload{} = file, should_dedupe, size_limit) do
     content_type = get_content_type(file.path)
 
-    uuid = get_uuid(file, should_dedupe)
-    name = get_name(file, uuid, content_type, should_dedupe)
-
+    with uuid <- get_uuid(file, should_dedupe),
+         name <- get_name(file, uuid, content_type, should_dedupe),
+         true <- check_file_size(file.path, size_limit) do
       strip_exif_data(content_type, file.path)
 
       {:ok, url_path} =
@@ -26,16 +35,18 @@ def store(%Plug.Upload{} = file, should_dedupe) do
         ],
         "name" => name
       }
+    else
+      _e -> nil
+    end
   end
 
-  def store(%{"img" => "data:image/" <> image_data}, should_dedupe) do
+  def store(%{"img" => "data:image/" <> image_data}, should_dedupe, size_limit) do
     parsed = Regex.named_captures(~r/(?<filetype>jpeg|png|gif);base64,(?<data>.*)/, image_data)
     data = Base.decode64!(parsed["data"], ignore: :whitespace)
 
-    tmp_path = tempfile_for_image(data)
-
-    uuid = UUID.generate()
-
+    with tmp_path <- tempfile_for_image(data),
+         uuid <- UUID.generate(),
+         true <- check_file_size(tmp_path, size_limit) do
       content_type = get_content_type(tmp_path)
       strip_exif_data(content_type, tmp_path)
 
@@ -46,7 +57,8 @@ def store(%{"img" => "data:image/" <> image_data}, should_dedupe) do
           content_type
         )
 
-    {:ok, url_path} = @storage_backend.put_file(name, uuid, tmp_path, content_type, should_dedupe)
+      {:ok, url_path} =
+        @storage_backend.put_file(name, uuid, tmp_path, content_type, should_dedupe)
 
       %{
         "type" => "Image",
@@ -59,6 +71,9 @@ def store(%{"img" => "data:image/" <> image_data}, should_dedupe) do
         ],
         "name" => name
       }
+    else
+      _e -> nil
+    end
   end
 
   @doc """

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -575,10 +575,13 @@ def fetch_activities_bounded(recipients_to, recipients_cc, opts \\ %{}) do
     |> Enum.reverse()
   end
 
-  def upload(file) do
-    data = Upload.store(file, Application.get_env(:pleroma, :instance)[:dedupe_media])
+  def upload(file, size_limit \\ nil) do
+    with data <-
+           Upload.store(file, Application.get_env(:pleroma, :instance)[:dedupe_media], size_limit),
+         false <- is_nil(data) do
       Repo.insert(%Object{data: data})
     end
+  end
 
   def user_data_from_user_object(data) do
     avatar =

lib/pleroma/web/mastodon_api/mastodon_api_controller.ex

@@ -35,6 +35,14 @@ def create_app(conn, params) do
   def update_credentials(%{assigns: %{user: user}} = conn, params) do
     original_user = user
 
+    avatar_upload_limit =
+      Application.get_env(:pleroma, :instance)
+      |> Keyword.fetch(:avatar_upload_limit)
+
+    banner_upload_limit =
+      Application.get_env(:pleroma, :instance)
+      |> Keyword.fetch(:banner_upload_limit)
+
     params =
       if bio = params["note"] do
         Map.put(params, "bio", bio)
@@ -52,7 +60,7 @@ def update_credentials(%{assigns: %{user: user}} = conn, params) do
     user =
       if avatar = params["avatar"] do
         with %Plug.Upload{} <- avatar,
-             {:ok, object} <- ActivityPub.upload(avatar),
+             {:ok, object} <- ActivityPub.upload(avatar, avatar_upload_limit),
              change = Ecto.Changeset.change(user, %{avatar: object.data}),
              {:ok, user} = User.update_and_set_cache(change) do
           user
@@ -66,7 +74,7 @@ def update_credentials(%{assigns: %{user: user}} = conn, params) do
     user =
       if banner = params["header"] do
         with %Plug.Upload{} <- banner,
-             {:ok, object} <- ActivityPub.upload(banner),
+             {:ok, object} <- ActivityPub.upload(banner, banner_upload_limit),
              new_info <- Map.put(user.info, "banner", object.data),
              change <- User.info_changeset(user, %{info: new_info}),
              {:ok, user} <- User.update_and_set_cache(change) do

lib/pleroma/web/nodeinfo/nodeinfo_controller.ex

@@ -113,6 +113,12 @@ def nodeinfo(conn, %{"version" => "2.0"}) do
         staffAccounts: staff_accounts,
         federation: federation_response,
         postFormats: Keyword.get(instance, :allowed_post_formats),
+        uploadLimits: %{
+          general: Keyword.get(instance, :upload_limit),
+          avatar: Keyword.get(instance, :avatar_upload_limit),
+          banner: Keyword.get(instance, :banner_upload_limit),
+          background: Keyword.get(instance, :background_upload_limit)
+        },
         features: features
       }
     }

lib/pleroma/web/twitter_api/twitter_api_controller.ex

@@ -263,7 +263,11 @@ def register(conn, params) do
   end
 
   def update_avatar(%{assigns: %{user: user}} = conn, params) do
-    {:ok, object} = ActivityPub.upload(params)
+    upload_limit =
+      Application.get_env(:pleroma, :instance)
+      |> Keyword.fetch(:avatar_upload_limit)
+
+    {:ok, object} = ActivityPub.upload(params, upload_limit)
     change = Changeset.change(user, %{avatar: object.data})
     {:ok, user} = User.update_and_set_cache(change)
     CommonAPI.update(user)
@@ -272,7 +276,11 @@ def update_avatar(%{assigns: %{user: user}} = conn, params) do
   end
 
   def update_banner(%{assigns: %{user: user}} = conn, params) do
-    with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}),
+    upload_limit =
+      Application.get_env(:pleroma, :instance)
+      |> Keyword.fetch(:banner_upload_limit)
+
+    with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, upload_limit),
          new_info <- Map.put(user.info, "banner", object.data),
          change <- User.info_changeset(user, %{info: new_info}),
          {:ok, user} <- User.update_and_set_cache(change) do
@@ -286,7 +294,11 @@ def update_banner(%{assigns: %{user: user}} = conn, params) do
   end
 
   def update_background(%{assigns: %{user: user}} = conn, params) do
-    with {:ok, object} <- ActivityPub.upload(params),
+    upload_limit =
+      Application.get_env(:pleroma, :instance)
+      |> Keyword.fetch(:background_upload_limit)
+
+    with {:ok, object} <- ActivityPub.upload(params, upload_limit),
          new_info <- Map.put(user.info, "background", object.data),
          change <- User.info_changeset(user, %{info: new_info}),
          {:ok, _user} <- User.update_and_set_cache(change) do