xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-10 21:30:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): tighten database restore body-cap exemption (#5609)

Browse Source
This commit is contained in:
n0ctal
2026-06-28 18:00:55 +05:00
committed by GitHub
parent bbfbd7eba6
commit 7f8cbf4c4b
3 changed files with 19 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/web.go
+3 -3
View File
@@ -168,9 +168,9 @@ func (s *Server) initRouter() (*gin.Engine, error) {
// Cap request bodies on state-changing requests so a stolen session/API
// token or a buggy client can't force large allocations or long DB
// transactions via bulk create/attach/import endpoints. GET/HEAD/OPTIONS
// carry no body and are left untouched. importDB restores a full SQLite
// backup that legitimately exceeds the cap, so it's exempt. Follow-up: make
// the limit a setting.
// carry no body and are left untouched. Database restore legitimately accepts
// large backups and streams them to disk, so only its exact route suffix is
// exempt. Follow-up: make the limit a setting.
const maxRequestBodyBytes = 10 << 20 // 10 MiB
engine.Use(middleware.MaxBodyBytes(maxRequestBodyBytes, "/panel/api/server/importDB"))