Merge pull request #1729 from hmhealey/plt886

PLT-886 Add additional max file size checks

2 files changed, 10 insertions, 0 deletions

diff --git a/api/file.go b/api/file.go
index 8afc70692..4339e610b 100644
--- a/api/file.go
+++ b/api/file.go
@@ -76,6 +76,12 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if r.ContentLength > model.MAX_FILE_SIZE {
+		c.Err = model.NewAppError("uploadFile", "Unable to upload file. File is too large.", "")
+		c.Err.StatusCode = http.StatusRequestEntityTooLarge
+		return
+	}
+
 	err := r.ParseMultipartForm(model.MAX_FILE_SIZE)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
diff --git a/web/react/components/user_settings/user_settings_general.jsx b/web/react/components/user_settings/user_settings_general.jsx
index 7c1a1297f..014038dd4 100644
--- a/web/react/components/user_settings/user_settings_general.jsx
+++ b/web/react/components/user_settings/user_settings_general.jsx
@@ -9,6 +9,7 @@ import UserStore from '../../stores/user_store.jsx';
 import ErrorStore from '../../stores/error_store.jsx';
 
 import * as Client from '../../utils/client.jsx';
+import Constants from '../../utils/constants.jsx';
 import * as AsyncClient from '../../utils/async_client.jsx';
 import * as Utils from '../../utils/utils.jsx';
 
@@ -156,6 +157,9 @@ export default class UserSettingsGeneralTab extends React.Component {
         if (picture.type !== 'image/jpeg' && picture.type !== 'image/png') {
             this.setState({clientError: 'Only JPG or PNG images may be used for profile pictures.'});
             return;
+        } else if (picture.size > Constants.MAX_FILE_SIZE) {
+            this.setState({clientError: 'Unable to upload profile image. File is too large.'});
+            return;
         }
 
         var formData = new FormData();