make Zope's parameters for denial of service protection configurable #1142
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dataflake
approved these changes
Jul 13, 2023
ale-rt
reviewed
Jul 13, 2023
drfho
approved these changes
Jul 13, 2023
|
drfho wrote at 2023-7-13 07:15 -0700:
...
In general I have some doubts whether this config is a good idea because even the default may generate troubles. And these errors are difficult to trace. Moreover (D)DOS protection can be considered as a webserver/firewall task and not the task of the app server. Maybe someone has a hint why this complication is needed at all?
The parameters (including their default values) come from
`multipart`, the third party product used for form processing
as replacement for Python's `cgi.FieldStorage`.
As `multipart` already contains the logic, there is not much
complexity added to `ZPublisher`.
Apparently, WSGI does not contain logic to parse/preprocess the
request for request variables but delegates this to the APP server
(or maybe WSGI middleware).
|
jensens
added a commit
to plone/cookiecutter-zope-instance
that referenced
this pull request
Oct 25, 2023
mauritsvanrees
added a commit
to plone/plone.restapi
that referenced
this pull request
Nov 2, 2023
This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142.
mauritsvanrees
added a commit
to plone/plone.restapi
that referenced
this pull request
Nov 2, 2023
This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142.
mauritsvanrees
added a commit
to plone/plone.restapi
that referenced
this pull request
Nov 2, 2023
This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142.
mauritsvanrees
referenced
this pull request
in plone/plone.restapi
Nov 2, 2023
This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. See `CMFPlone issue 3848 <https://github.com/plone/Products.CMFPlone/issues/3848>`_ and `Zope PR 1142 <https://github.com/zopefoundation/Zope/pull/1142>`_.
mauritsvanrees
referenced
this pull request
in plone/plone.restapi
Nov 2, 2023
This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. See `CMFPlone issue 3848 <https://github.com/plone/Products.CMFPlone/issues/3848>`_ and `Zope PR 1142 <https://github.com/zopefoundation/Zope/pull/1142>`_.
tisto
pushed a commit
to plone/plone.restapi
that referenced
this pull request
Nov 4, 2023
…1729) * Allow uploads up to 16 MB. This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142. * Changed patch: temporarily disable form memory limit checking for files and images. This seems a better way, then increasing the limit to 16MB. See zopefoundation/Zope#1180 (comment)
mister-roboto
pushed a commit
to plone/buildout.coredev
that referenced
this pull request
Nov 4, 2023
Branch: refs/heads/main Date: 2023-11-04T07:13:09+01:00 Author: Maurits van Rees (mauritsvanrees) <maurits@vanrees.org> Commit: plone/plone.restapi@9f399ac Temporarily disable form memory limit checking for files and images. (#1729) * Allow uploads up to 16 MB. This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142. * Changed patch: temporarily disable form memory limit checking for files and images. This seems a better way, then increasing the limit to 16MB. See zopefoundation/Zope#1180 (comment) Files changed: A news/3848.bugfix A src/plone/restapi/patches.py M src/plone/restapi/__init__.py M src/plone/restapi/deserializer/__init__.py
mister-roboto
pushed a commit
to plone/buildout.coredev
that referenced
this pull request
Nov 4, 2023
Branch: refs/heads/main Date: 2023-11-04T07:13:09+01:00 Author: Maurits van Rees (mauritsvanrees) <maurits@vanrees.org> Commit: plone/plone.restapi@9f399ac Temporarily disable form memory limit checking for files and images. (#1729) * Allow uploads up to 16 MB. This fixes a regression due to a low Zope form memory limit of 1MB used since Plone 6.0.7. You can use ``dos_protection`` settings in ``etc/zope.conf`` to change the limit. See plone/Products.CMFPlone#3848 and zopefoundation/Zope#1142. * Changed patch: temporarily disable form memory limit checking for files and images. This seems a better way, then increasing the limit to 16MB. See zopefoundation/Zope#1180 (comment) Files changed: A news/3848.bugfix A src/plone/restapi/patches.py M src/plone/restapi/__init__.py M src/plone/restapi/deserializer/__init__.py
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1141.