CaramelFur/Picsur

Add a settings to limit the width & height params

lionep opened this issue · 3 comments

lionep commented

Hello,

Nice project out there !
I've tried it and it seems you can overscale pictures, and get some insufficient memory usage.

Would it be possible to implement :

  • A config params (as environment variable) to prevent overscale (width or height, over original width or height)
  • A config params to define maximum allowed width or height in query params, returning an error if user goes above the value.

Also, it seems that every different size request is stored in e_image_derivative_backend table, so a anon user can fillup the disk with commands like :

for I in `seq 100 500`; do
  curl -v https://picsur.domain.com/i/SOME_PICTURE_ID.jpg\?height\=$I
done

Any idea of a protection agains this ?

Thanks !