-
-
Notifications
You must be signed in to change notification settings - Fork 73
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
extractCredentials: do not fail when the request is too large to read. #1726
extractCredentials: do not fail when the request is too large to read. #1726
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
@jenkins-plone-org please run jobs |
As alternative, or as extra, we could do this before calling
This was suggested by @davisagli in plone/Products.CMFPlone#3848 (comment) In my case in ClassicUI during an image upload, the content type is something like |
✅ Deploy Preview for plone-restapi canceled.
|
@mauritsvanrees In both of those cases, the request does not have a JSON body, and we don't want to waste effort in trying to parse it as JSON. The only problem would be if there is a client which is sending a JSON body but not sending the It should be a conditional around the code that tries to get login & password from the JSON body though, not a return out of the function. We still need to run the code after that looks for the token in the Authorization header, regardless of request content type. |
Hmm, the whole chunk of code looking for login and password in the request body seems misplaced. Shouldn't that be done only in the login service? |
I think you are right. Theoretically this chunk gets a dict with |
Do note this remark in
But as said, that should not have any effect. I will keep this PR, as it should be okay, but then create another one where I remove these lines. |
The result was never used, and it may fail when the request is too large to read. This is a problem since at least Zope 5.8.4, introduced in Plone 6.0.7. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1180. This PR is an alternative to #1726. See discussion there.
Closed in favour of PR #1728. |
This is a problem since at least Zope 5.8.4, introduced in Plone 6.0.7.
See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1180.
This PR makes sure that a too big request body does not throw an error when extracting credentials. This makes large image upload work again in ClassicUI with
plone.restapi
installed.Uploading a file or image larger than 1MB using
plone.restapi
still likely fails, unless you have increased theform-memory-limit
inzope.conf
. Fixing this may need a change along these lines, but that would be a more far reaching change that needs careful consideration.