From a103dbf801a96399d39a44f4a0f5c8007bb33cb8 Mon Sep 17 00:00:00 2001 From: Katie Smith Date: Fri, 6 Sep 2019 11:13:05 +0100 Subject: [PATCH] Add max file size check when uploading a letter --- app/main/views/uploads.py | 6 ++++++ tests/app/main/views/test_uploads.py | 14 ++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/app/main/views/uploads.py b/app/main/views/uploads.py index a93fc7427..052329766 100644 --- a/app/main/views/uploads.py +++ b/app/main/views/uploads.py @@ -9,6 +9,8 @@ from app.main import main from app.main.forms import PDFUploadForm from app.utils import user_has_permissions +MAX_FILE_UPLOAD_SIZE = 2 * 1024 * 1024 # 2MB + @main.route("/services//uploads") @user_has_permissions('send_messages') @@ -29,6 +31,10 @@ def upload_letter(service_id): flash('Your file has failed the virus check', 'dangerous') return render_template('views/uploads/choose-file.html', form=form), 400 + if len(pdf_file_bytes) > MAX_FILE_UPLOAD_SIZE: + flash('Your file must be smaller than 2MB', 'dangerous') + return render_template('views/uploads/choose-file.html', form=form), 400 + upload_id = uuid.uuid4() return redirect( diff --git a/tests/app/main/views/test_uploads.py b/tests/app/main/views/test_uploads.py index 67e5999b0..530130e74 100644 --- a/tests/app/main/views/test_uploads.py +++ b/tests/app/main/views/test_uploads.py @@ -76,6 +76,20 @@ def test_post_upload_letter_shows_error_when_file_contains_virus(mocker, client_ assert normalize_spaces(page.select('.banner-dangerous')[0].text) == 'Your file has failed the virus check' +def test_post_choose_upload_file_when_file_is_too_big(mocker, client_request): + mocker.patch('app.main.views.uploads.antivirus_client.scan', return_value=True) + + with open('tests/test_pdf_files/big.pdf', 'rb') as file: + page = client_request.post( + 'main.upload_letter', + service_id=SERVICE_ONE_ID, + _data={'file': file}, + _expected_status=400 + ) + assert page.find('h1').text == 'Upload a letter' + assert normalize_spaces(page.select('.banner-dangerous')[0].text) == 'Your file must be smaller than 2MB' + + def test_uploaded_letter_preview(client_request): page = client_request.get( 'main.uploaded_letter_preview',