[mod_python] finding length of user file before uploading-revisit

On 7/18/06, Kevin Albright <albrightk at gmail.com> wrote:
> I am attempting Graham Dumpleton's solution (April 2006) to prevent uploads
> of files that are deemed to large with the suggested handler he posted
> (shown below).  I have the PythonFixupHandler listed before
> mod_python.publisher as instructed in httpd.conf.  Trying this method, I
> receive the message "upload too big" returned but only after finishing the
> upload of the offending file (I am assuming that the Fixup handler is not
> preventing publisher from uploading).  I appreciate any help or insight
> others can offer.  Many thanks, Kevin

Unfortunately neither HTTP or HTML have any way for the server
to inform the client about any length limitations it may impose.  It can
only react after the "upload" has begin.   There's nothing that
mod_python can do specifically to work around these HTTP
shortcomings.  But there are still some more things for you to do...

> >> ...
> >> length = int(req.headers_in.get("Content-Length", "0"))

Normally, it is optional for the client to send a Content-Length
header.  That's why the get() method here uses a default of 0.
However, the server is allowed to refuse requests that don't
specify a content length, by returning a 411 "Length Required"
error.  So you could do instead something like,

   length = req.headers_in.get("Content-Length")
   if length is None:
       req.status = apache.HTTP_LENGTH_REQUIRED
       return apache.DONE
   length = int(length)

Note that you should also probably only do any of this
checking for POST, PUT, or perhaps HEAD requests.

> >> if length >= UPLOAD_LIMIT:
> >>   req.content_type  = 'text/plain'
> >>   req.status = apache.HTTP_BAD_REQUEST

You should be returning a 413 "Request Entity Too Large"
error rather than a 400---which is the python constant:
    apache.HTTP_REQUEST_ENTITY_TOO_LARGE

> >>   req.write('upload too big\n')
> >>   return apache.DONE

Note that per the HTTP 1.1 RFC 2616 section 10.4.14 the
server is allowed to forcibly close the connection in this
condition, thereby immediately interrupting the continued
upload of data.  I'm not sure exactly how mod_python can
do that.
-- 
Deron Meranda