#30669: Can FILE_UPLOAD_MAX_MEMORY_SIZE be set to None?
-------------------------------------+-------------------------------------
Reporter: Lincoln | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
FILE_UPLOAD_MAX_MEMORY_SIZE, |
None, settings |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Carlton Gibson):
* component: File uploads/storage => HTTP handling
Comment:
Replying to [comment:4 Claude Paroz]:
> I'm not sure about your explanation of later size check. What if a
request has "unlimited" (i.e. *very* big) length?
OK, so this is where it get's tricky. 🙂
As it stands if the request is "unlimited" we'd end up using **a lotâ„¢** of
disk space. Whatever frontend server is in play should put an absolute
limit on request sizes, and we could document the need for that in the
deployment checklist, but we should have some kind of ceiling here.
`DATA_UPLOAD_MAX_MEMORY_SIZE` is not really the correct measure. **At this
point** we want to limit the total size of the request.
`DATA_UPLOAD_MAX_MEMORY_SIZE` is applied to only to the `POST` data, with
`FILES` being handled separately (in MultipartParser, as you point to
Claude.) The danger is we limit total request size to
`DATA_UPLOAD_MAX_MEMORY_SIZE` and in so doing stop people handling large
file uploads.
So, total request size should be limited to (something like) the amount of
POST data I want to handle in memory (`DATA_UPLOAD_MAX_MEMORY_SIZE`) plus
the maximum file size I want to allow to be uploaded (which isn't
`FILE_UPLOAD_MAX_MEMORY_SIZE` either).
Whilst we need to read in the request here, I guess we can decide a
generous but sensible default, and allow folks to set their own value.
Personally I'd rather avoid a setting and let people pass a parameter in
their `asgi.py` when instantiating the application (or use an
`ASGIHandler` subclass which specifies it) but what do others think?
--
Ticket URL: <https://code.djangoproject.com/ticket/30669#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/070.adaf968cbe6abb5023ea1803afe19ae8%40djangoproject.com.
