From ab991458ada0ca5b2dae31a04b068711e533abc3 Mon Sep 17 00:00:00 2001
From: Robin McCorkell <rmccorkell@karoshi.org.uk>
Date: Fri, 27 Mar 2015 23:43:35 +0000
Subject: [PATCH] Require minimum 1 MiB upload limit

---
 lib/private/files.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/private/files.php b/lib/private/files.php
index e93b98a1891..0f48dca9715 100644
--- a/lib/private/files.php
+++ b/lib/private/files.php
@@ -52,6 +52,8 @@ class OC_Files {
 	const ZIP_FILES = 2;
 	const ZIP_DIR = 3;
 
+	const UPLOAD_MIN_LIMIT_BYTES = 1048576; // 1 MiB
+
 	/**
 	 * @param string $filename
 	 * @param string $name
@@ -246,15 +248,17 @@ class OC_Files {
 	 * @return bool false on failure, size on success
 	 */
 	static function setUploadLimit($size) {
-		//don't allow user to break his config -- upper boundary
+		//don't allow user to break his config
 		if ($size > PHP_INT_MAX) {
 			//max size is always 1 byte lower than computerFileSize returns
 			if ($size > PHP_INT_MAX + 1)
 				return false;
 			$size -= 1;
-		} else {
-			$size = OC_Helper::phpFileSize($size);
 		}
+		if ($size < self::UPLOAD_MIN_LIMIT_BYTES) {
+			return false;
+		}
+		$size = OC_Helper::phpFileSize($size);
 
 		//don't allow user to break his config -- broken or malicious size input
 		if (intval($size) === 0) {
-- 
2.39.5