@@ -, +, @@ translate alerts Note that normally the table will still be empty, but a large fallback is used. again when processing it. the input[type=file] control to the template. upload_settings: type=filesize, count1=1000. javascript validation after the first size check. --- C4/UploadedFiles.pm | 37 ++++++++++++-- cataloguing/value_builder/upload.pl | 14 ++---- .../en/modules/cataloguing/value_builder/upload.tt | 51 ++++++++++---------- t/db_dependent/UploadedFiles.t | 42 +++++++++++++++- 4 files changed, 105 insertions(+), 39 deletions(-) --- a/C4/UploadedFiles.pm +++ a/C4/UploadedFiles.pm @@ -59,6 +59,8 @@ use File::Basename; use C4::Context; +use constant MAX_DEFAULT_UPLOAD => 10000000; # relatively large fallback; + sub _get_file_path { my ($id, $dirname, $filename) = @_; @@ -142,12 +144,22 @@ sub UploadFile { return; } + my $ue = C4::Context->userenv; + my $owner = $ue? $ue->{number}: undef; + my $max = C4::UploadedFiles::MaxUploadSize( $owner ); + my $buffer; my $data = ''; - while($handle->read($buffer, 1024)) { + while( $handle->read($buffer, 1024) && length($data) <= $max ) { $data .= $buffer; } $handle->close; + if( length($data) > $max ) { + # double check actually (see js); normally not possible, so we just + # rely on a general error message and a warn + warn "UploadFile: upload size exceeded after submit!"; + return; + } my $sha = new Digest::SHA; $sha->add($data); @@ -180,8 +192,6 @@ sub UploadFile { VALUES (?,?, ?, ?, ?); }; my $sth = $dbh->prepare($query); - my $ue = C4::Context->userenv; - my $owner = $ue? $ue->{number}: undef; if( $sth->execute($id, $filename, $dir, length($data), $owner ) ) { return $id; } @@ -335,4 +345,25 @@ sub httpheaders { '-attachment' => $file, ); } +=head2 MaxUploadSize + + Returns max upload size for borrower or if the borrower has no explicit + user limit, the default max. If no records are found, falls back to a + constant. + +=cut + +sub MaxUploadSize { + my ( $user ) = @_; + my $dbh = C4::Context->dbh; + my $query = qq| +SELECT count1 FROM upload_settings +WHERE (borrowernumber=? OR borrowernumber IS NULL) AND + type='filesize' +ORDER BY IFNULL(borrowernumber, 0) DESC; + |; + my ( $max ) = $dbh->selectrow_array( $query, undef, ( $user ) ); + return $max // MAX_DEFAULT_UPLOAD; +} + 1; --- a/cataloguing/value_builder/upload.pl +++ a/cataloguing/value_builder/upload.pl @@ -90,10 +90,9 @@ my $launcher = sub { $id = C4::UploadedFiles::UploadFile($uploaded_file, $dir, $fh->handle); my $OPACBaseURL = C4::Context->preference('OPACBaseURL') // ''; $OPACBaseURL =~ s#/$##; - if (!$OPACBaseURL) { - $template->param(MissingURL => 1); - } - if($id && $OPACBaseURL) { + if( !$OPACBaseURL ) { + $template->param( MissingURL => 1 ); + } elsif( $id ) { my $return = "$OPACBaseURL/cgi-bin/koha/opac-retrieve-file.pl?id=$id"; $template->param( success => 1, @@ -116,11 +115,6 @@ my $launcher = sub { } else { my $upload_path = C4::Context->config('upload_path'); if ($upload_path) { - my $filefield = CGI::filefield( - -name => 'uploaded_file', - -size => 50, - ); - my $dirs_tree = [ { name => '/', value => '/', @@ -129,7 +123,7 @@ my $launcher = sub { $template->param( dirs_tree => $dirs_tree, - filefield => $filefield, + maxfilesize => C4::UploadedFiles::MaxUploadSize($loggedinuser), ); } else { $template->param( error_upload_path_not_configured => 1 ); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/upload.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/upload.tt @@ -7,32 +7,33 @@ @@ -102,9 +103,9 @@ [% IF (dangling) %]
Error: The URL has no file to retrieve.
[% END %] -