diff --git a/CHANGELOG.md b/CHANGELOG.md index ec4d0851..4e5f8059 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,7 @@ ## v0.23.12 (WIP) +- Skipped the default body size limit middleware for the backup upload endpooint ([#6152](https://github.com/pocketbase/pocketbase/issues/6152)). + - Added warning logs in case of mismatched `modernc.org/sqlite` and `modernc.org/libs` versions ([#6136](https://github.com/pocketbase/pocketbase/issues/6136#issuecomment-2556336962)). diff --git a/apis/backup.go b/apis/backup.go index db15c80c..f1f2eb6e 100644 --- a/apis/backup.go +++ b/apis/backup.go @@ -18,7 +18,7 @@ func bindBackupApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) { sub := rg.Group("/backups") sub.GET("", backupsList).Bind(RequireSuperuserAuth()) sub.POST("", backupCreate).Bind(RequireSuperuserAuth()) - sub.POST("/upload", backupUpload).Bind(RequireSuperuserAuth()) + sub.POST("/upload", backupUpload).Bind(BodyLimit(0), RequireSuperuserAuth()) sub.GET("/{key}", backupDownload) // relies on superuser file token sub.DELETE("/{key}", backupDelete).Bind(RequireSuperuserAuth()) sub.POST("/{key}/restore", backupRestore).Bind(RequireSuperuserAuth()) diff --git a/apis/backup_test.go b/apis/backup_test.go index 0caec65a..ca4f5c10 100644 --- a/apis/backup_test.go +++ b/apis/backup_test.go @@ -10,6 +10,7 @@ import ( "strings" "testing" + "github.com/pocketbase/pocketbase/apis" "github.com/pocketbase/pocketbase/core" "github.com/pocketbase/pocketbase/tests" "gocloud.dev/blob" @@ -346,6 +347,19 @@ func TestBackupUpload(t *testing.T) { ExpectedStatus: 204, ExpectedEvents: map[string]int{"*": 0}, }, + { + Name: "ensure that the default body limit is skipped", + Method: http.MethodPost, + URL: "/api/backups/upload", + Body: bytes.NewBuffer(make([]byte, apis.DefaultMaxBodySize+100)), + Headers: map[string]string{ + "Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY", + }, + ExpectedStatus: 400, // it doesn't matter as long as it is not 413 + ExpectedContent: []string{`"data":{`}, + NotExpectedContent: []string{"entity too large"}, + ExpectedEvents: map[string]int{"*": 0}, + }, } for _, scenario := range scenarios {