From d0bda06562df3ebb5ceb4a1f87a18fdef1e6902b Mon Sep 17 00:00:00 2001
From: Sebastian Stehle <sebastian@squidex.io>
Date: Wed, 20 Mar 2019 15:26:18 +0100
Subject: [PATCH] Correct handling of large files in Kestrel.

---
 .../Controllers/Assets/AssetsController.cs    |  2 +
 .../AssetRequestSizeLimitAttribute.cs         | 44 +++++++++++++++++++
 .../app/shared/services/assets.service.ts     | 12 +++--
 3 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 src/Squidex/Pipeline/AssetRequestSizeLimitAttribute.cs

diff --git a/src/Squidex/Areas/Api/Controllers/Assets/AssetsController.cs b/src/Squidex/Areas/Api/Controllers/Assets/AssetsController.cs
index 1d79b1ffd..d467d6543 100644
--- a/src/Squidex/Areas/Api/Controllers/Assets/AssetsController.cs
+++ b/src/Squidex/Areas/Api/Controllers/Assets/AssetsController.cs
@@ -171,6 +171,7 @@ namespace Squidex.Areas.Api.Controllers.Assets
         [Route("apps/{app}/assets/")]
         [ProducesResponseType(typeof(AssetCreatedDto), 201)]
         [ProducesResponseType(typeof(ErrorDto), 400)]
+        [AssetRequestSizeLimit]
         [ApiPermission(Permissions.AppAssetsCreate)]
         [ApiCosts(1)]
         public async Task<IActionResult> PostAsset(string app, [SwaggerIgnore] List<IFormFile> file)
@@ -233,6 +234,7 @@ namespace Squidex.Areas.Api.Controllers.Assets
         [HttpPut]
         [Route("apps/{app}/assets/{id}/")]
         [ProducesResponseType(typeof(ErrorDto), 400)]
+        [AssetRequestSizeLimit]
         [ApiPermission(Permissions.AppAssetsUpdate)]
         [ApiCosts(1)]
         public async Task<IActionResult> PutAsset(string app, Guid id, [FromBody] UpdateAssetDto request)
diff --git a/src/Squidex/Pipeline/AssetRequestSizeLimitAttribute.cs b/src/Squidex/Pipeline/AssetRequestSizeLimitAttribute.cs
new file mode 100644
index 000000000..17236e81a
--- /dev/null
+++ b/src/Squidex/Pipeline/AssetRequestSizeLimitAttribute.cs
@@ -0,0 +1,44 @@
+// ==========================================================================
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex UG (haftungsbeschraenkt)
+//  All rights reserved. Licensed under the MIT license.
+// ==========================================================================
+
+using System;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Mvc.Internal;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Squidex.Domain.Apps.Entities.Assets;
+
+namespace Squidex.Pipeline
+{
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
+    public sealed class AssetRequestSizeLimitAttribute : Attribute, IFilterFactory, IOrderedFilter
+    {
+        public int Order { get; set; } = 900;
+
+        public bool IsReusable => true;
+
+        public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
+        {
+            var assetOptions = serviceProvider.GetService<IOptions<AssetOptions>>();
+
+            if (assetOptions?.Value.MaxSize > 0)
+            {
+                var filter = serviceProvider.GetRequiredService<RequestSizeLimitFilter>();
+
+                filter.Bytes = assetOptions.Value.MaxSize;
+
+                return filter;
+            }
+            else
+            {
+                var filter = serviceProvider.GetRequiredService<DisableRequestSizeLimitFilter>();
+
+                return filter;
+            }
+        }
+    }
+}
diff --git a/src/Squidex/app/shared/services/assets.service.ts b/src/Squidex/app/shared/services/assets.service.ts
index 1f74a935a..cb4da15de 100644
--- a/src/Squidex/app/shared/services/assets.service.ts
+++ b/src/Squidex/app/shared/services/assets.service.ts
@@ -247,8 +247,10 @@ export class AssetsService {
                         return throwError(error);
                     }
                 }),
-                tap(() => {
-                    this.analytics.trackEvent('Asset', 'Uploaded', appName);
+                tap(value => {
+                    if (!Types.isNumber(value)) {
+                        this.analytics.trackEvent('Asset', 'Uploaded', appName);
+                    }
                 }),
                 pretifyError('Failed to upload asset. Please reload.'));
     }
@@ -320,8 +322,10 @@ export class AssetsService {
                         return throwError(error);
                     }
                 }),
-                tap(() => {
-                    this.analytics.trackEvent('Analytics', 'Replaced', appName);
+                tap(value => {
+                    if (!Types.isNumber(value)) {
+                        this.analytics.trackEvent('Analytics', 'Replaced', appName);
+                    }
                 }),
                 pretifyError('Failed to replace asset. Please reload.'));
     }