WebDAV: Limit PUT upload size to the configured originals limit

Cap the WebDAV PUT request body at OriginalsLimitBytes when an originals limit is configured, so a single upload cannot stream an unbounded body to disk past the per-file ceiling; no-op when unlimited. Adds a load-bearing regression test.

Author: lastzero

internal/server/webdav.go

@@ -11,6 +11,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"golang.org/x/net/webdav"
 
+	"github.com/photoprism/photoprism/internal/api"
 	"github.com/photoprism/photoprism/internal/config"
 	"github.com/photoprism/photoprism/internal/mutex"
 	"github.com/photoprism/photoprism/internal/workers/auto"
@@ -118,6 +119,15 @@ func WebDAV(dir string, router *gin.RouterGroup, conf *config.Config) {
 			}
 		}
 
+		// Bound an uploaded file to the configured originals size limit (when set) so a single
+		// PUT cannot stream an unbounded body to disk; the free-storage check above only catches
+		// the next request. No-op when no originals limit is configured.
+		if c.Request.Method == header.MethodPut {
+			if limit := conf.OriginalsLimitBytes(); limit > 0 {
+				api.LimitRequestBodyBytes(c, limit)
+			}
+		}
+
 		// Invoke handler callback.
 		WebDAVHandler(c, router, srv)
 	}

internal/server/webdav_write_test.go

@@ -64,6 +64,37 @@ func TestWebDAVWrite_MKCOL_PUT(t *testing.T) {
 	assert.Equal(t, "hello", string(b))
 }
 
+func TestWebDAVWrite_PUT_OriginalsLimit(t *testing.T) {
+	conf := newWebDAVTestConfig(t)
+	conf.Options().OriginalsLimit = 1 // cap uploaded files at 1 MB
+	if err := conf.CreateDirectories(); err != nil {
+		t.Fatalf("failed to create test directories: %v", err)
+	}
+	r := setupWebDAVRouter(conf)
+
+	t.Run("UnderLimitAccepted", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(header.MethodPut, conf.BaseUri(WebDAVOriginals)+"/small.bin", bytes.NewReader(make([]byte, 512*1024)))
+		authBearer(req)
+		r.ServeHTTP(w, req)
+		assert.InDelta(t, 201, w.Code, 1)
+	})
+	t.Run("OverLimitRejected", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(header.MethodPut, conf.BaseUri(WebDAVOriginals)+"/big.bin", bytes.NewReader(make([]byte, 2*1024*1024)))
+		authBearer(req)
+		r.ServeHTTP(w, req)
+		// The oversized PUT must not be accepted, and the bytes written to disk must not
+		// exceed the configured originals limit (the body cap stops io.Copy mid-stream).
+		assert.NotEqual(t, http.StatusCreated, w.Code)
+		path := filepath.Join(conf.OriginalsPath(), "big.bin")
+		// #nosec G304 -- test reads file created under controlled temp directory.
+		if info, err := os.Stat(path); err == nil {
+			assert.LessOrEqual(t, info.Size(), conf.OriginalsLimitBytes())
+		}
+	})
+}
+
 func TestWebDAV_NoTrailingSlashRedirectOnBasePath(t *testing.T) {
 	testCases := []struct {
 		name    string