Friday, August 11, 2023
1 change · master
Security fixes and vulnerability patches
Odoo now enforces maximum upload size checks on the server, not just in the browser. This helps prevent oversized or forged uploads from consuming storage and processing resources, especially for on-premise installations.
Original PR description
The limit was only enforced by the front-end, meaning that anybody could forge a request with a huge file and get it processed by Odoo. According to the documentation of werkzeug[^1], such limit should be enforced by the server server instead of the wsgi application. It is the case for Odoo Online but on-premise customers might not configure their servers. The `web.max_file_upload_size` system paramter is now enforced upon parsing the content of the request. It defaults at 128 MiB which is enough for most documents and images. We do not want to host large files (e.g. videos) in the Odoo filestore. [^1]: https://werkzeug.palletsprojects.com/en/2.0.x/request_data/ Fixes: #124646