globaleaks / globaleaks-whistleblowing-software

GlobaLeaks is free, open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.
https://www.globaleaks.org
Other
1.23k stars 271 forks source link

A maximum_json variable is needed in GLBackend DB and must be configurable by GLSettings #407

Open evilaliv3 opened 11 years ago

evilaliv3 commented 11 years ago

with reference to issue/86 we need to define a new GLSetting variable to set the upper limit for a JSON request.

Currently we have a maximum_filesize variable used for the uploads and that will be probably set in MBbytes (and will propbably indicate serveral gigabytes)

We also need a maximum_jsonsize variable used for every other request (different from an upload) and that will be probably set in Bytes (and will probably indicate some kB)

This new variable need to be configurable on GLClient through Adavanced Settings and need it's introduction in the DB on the backend side).

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

fpietrosanti commented 11 years ago

Applied tags

vecna commented 11 years ago

at the moment the data configurable via API advanced settings, node level, are:

json max size it's a composite data that can't be easily manage by an admin. in example, text max size, is apply to the fields submitted by wb.

suppose you've a limit of 4k for every text.

a field configured with three text entry, would be up to 12k, a field with only one entry, 4k. having a json limits would cripple these detailed check.

it's not better just take a multiple of maximum_textsize and know that admin can tune the more defined variable ?

evilaliv3 commented 11 years ago

i'm in doubt because for eventual networking/application firewalling et cetera and other we will probably in future will have to estimate the maximum request payload in a precise way.

vecna commented 11 years ago

it's not a problem, similar to the validation of the fields (that need to be done) can be done also a length counter. the highest of these values + longest translated string + metadata shall be max_json.