Q about security and maxTotalFileSize

Hi, I need to solve this problem before I can move on, I submitted a response problem.
Im also pasting the Q here, as it may be help to others, or perhaps others can help me on this, and I believe my initial post may not have been clear.

---

ImageUploader:
Restriction rules are set client side so a mailcious user can easily bypass these, and as your documentation correctly states these limitations are for the convenience to the user.

So a mailicious user can upload 1000+ files, so server side checking needs to be done to prevent any extra files being uploaded:

I have done this, on server side the files are not saved if the user is over his download quota. These files are being uploaded/saved individually.
Q: Is there a method or can you suggest a way to break out of the upload? That is, once the user is over the limit I want to break out of the upload? Im using asp.net I tried Response.Redirect, and server.Transfer but these do not work correctly (i wasnt sure what else I could do). Can you please advise me on how to correctly break out of the download.

If there is no way to break out of the download what is stopping a mailicous user from uploading 1000+ files. Even though we can check server side, and not save the files, bandwidth will still be consumed on the server as we iterate these 1000+ files.

Thanks for any help.

Hi Alex,

Yes, but those are client side restrictions, a mailicous user can easily bypass client side restrictions.

Even your own documentation states this:

http://www.aurigma.com/d...orFilesNumberandSize.htm

The 4th paragraph states:
"One more important notice: as these limitations are only client-side checks, you should not treat them as protection for your server. Since the malicious users can pass them around, e.g. by creating a local copy of this page and modifying of all the parameters, you should always check uploaded data on the server side. That's why use these limitations only for the convenience of the user"
---

So, we if we determine that the user has uploaded more than his quota server side, then how can we break out of the upload? Any ideas on what to do?

Thankyou

========================================================
02/18/2008, Fedor

If you will find during server-side upload processing that user tries to bypass client side restrictions, then you can just break HTTP connection. For example in ASP.NET it can be done using Response.End().
========================================================

Edited by user Wednesday, October 29, 2008 1:40:57 PM(UTC)  | Reason: Not specified