ZIP downloads should not be possible to disable

[jancborchardt]

Why is it possible for admins to disable zip downloads, if the system can handle it? If for security it should be fixed differently. If it’s not supported by the server then it’s just not possible and the setting shouldn’t show.

Now apparently the reason for this setting is that the server can be overloaded through this feature. Now how exactly can that happen? And why is it ok to let people set an option then which potentially will kill their server. If it’s too many files, too many subsequent downloads or something like that it should be blocked in the code instead of having a zip-killswitch.

@LukasReschke @DeepDiver1975 what do you think?
(Issue originally from my comments on #1257 )

[karlitschek]

I think the original idea was that an ownCloud server "explodes" if you try to create a huge zip file which than could kill the server for others too. Because of that we introduced it last year as far as I know. I think @blizzz worked on that. The perfect solution would be of course if ownCloud would handle this somehow internally without the config option. But might be tricky.

[blizzz]

Exactly. Zip generation will eat all your CPU and if you try to download a huuuge folder, ownCloud (and other services running there) will be inaccessible.

[blizzz]

P.S.: You can also only allow Zip generation if a certain input size is exceeded. If you dislike it being in the Settings UI, we may move it to config.php.

[DeepDiver1975]

We have still an open pull request which tries to handle zip creation at a low memory profile - a solution to this?
#3439

[jancborchardt]

New pull request seems to be at #6893

[PVince81]

Now that the zip streaming works, should we go ahead and remove that option ?

[PVince81]

@ghiamar @5meter I saw in separate bug reports that you guys had the option "allow zip download disabled". Can you confirm that you did this only to save some server resources and remove the need to have a temporary folder with available space ?

This is planned for removal in OC 7 because the zip file is now built on the fly and streamed directly back to the client (no more temporary file).

Thanks.

[mgscreativa]

Well, I really love to have that option disabled, because I dont want to give anyone the opsiility to download a complete shared folder generating a huge zip file...

[PVince81]

Even if that huge zip file isn't stored anywhere on the server and streamed directly to the client ?

[mgscreativa]

Well, if it doesn't kill my server ram, its ok I guess...

[mgscreativa]

@PVince81 Forgot to mention, thatnks for asking!

[PVince81]

Just re-read the comments above, would be good to double check if the current mechanism still "eats the CPU" when making a zip file.

[jancborchardt]

Fixed by removal of the setting. Thanks @MorrisJobke! :)

[jancborchardt]

(Also, by adding zipstreamer – thank you @McNetic! :)