fix: limit logo size

ONLYOFFICE · Nov 13, 2024 · e6ad884 · e6ad884
1 parent d1da085
commit e6ad884
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/...ion/src/main/java/com/asc/registration/application/security/filter/RateLimiterFilter.java b/...ion/src/main/java/com/asc/registration/application/security/filter/RateLimiterFilter.java
@@ -99,9 +99,11 @@ private void handleRequest(
     var probe = bucket.tryConsumeAndReturnRemaining(1);
     response.setHeader(X_RATE_REMAINING, String.valueOf(probe.getRemainingTokens()));
     response.setHeader(X_RATE_RESET, String.valueOf(probe.getNanosToWaitForReset()));
-    response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
-    if (probe.isConsumed()) {
-      chain.doFilter(request, response);
+    if (!probe.isConsumed()) {
+      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
+      return;
     }
+
+    chain.doFilter(request, response);
   }
 }
diff --git a/...main/java/com/asc/registration/application/transfer/CreateTenantClientCommandRequest.java b/...main/java/com/asc/registration/application/transfer/CreateTenantClientCommandRequest.java
@@ -111,7 +111,7 @@ public class CreateTenantClientCommandRequest implements Serializable {
   @Pattern(
       regexp = "^data:image\\/(?:png|jpeg|jpg|svg\\+xml);base64,.*.{1,}",
       message = "client logo is expected to be passed as base64")
-  @LogoSize
+  @LogoSize(maxBytes = 1048576, maxLength = 2000000)
   private String logo;
 
   /** Indicates whether PKCE is allowed for the client. */