From 947d9dc57a9a040a2a67d7e8a4f998cb73a9523c Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Wed, 16 Feb 2022 09:39:06 +0000
Subject: [PATCH] limit preview to 10 MB

---
 app/controllers/api/storage.php             | 4 ++++
 app/init.php                                | 1 +
 docs/references/storage/get-file-preview.md | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/controllers/api/storage.php b/app/controllers/api/storage.php
index ff0ae96aa7..c8441c971a 100644
--- a/app/controllers/api/storage.php
+++ b/app/controllers/api/storage.php
@@ -909,6 +909,10 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
             throw new Exception('File not found', 404);
         }
 
+        if($file->getAttribute('sizeActual') > APP_LIMIT_PREVIEW) {
+            throw new Exception('Preview not supported for file above ' . Storage::human(APP_LIMIT_PREVIEW) . ' in size.');
+        }
+
         $path = $file->getAttribute('path');
         $type = \strtolower(\pathinfo($path, PATHINFO_EXTENSION));
         $algorithm = $file->getAttribute('algorithm');
diff --git a/app/init.php b/app/init.php
index 1b4b0f18bf..92ae380fb2 100644
--- a/app/init.php
+++ b/app/init.php
@@ -67,6 +67,7 @@ const APP_LIMIT_USERS = 10000;
 const APP_LIMIT_ANTIVIRUS = 20000000; //20MB
 const APP_LIMIT_ENCRYPTION = 20000000; //20MB
 const APP_LIMIT_COMPRESSION = 20000000; //20MB
+const APP_LIMIT_PREVIEW = 10000000; //10MB file size limit for preview endpoint
 const APP_CACHE_BUSTER = 201;
 const APP_VERSION_STABLE = '0.13.0';
 const APP_DATABASE_ATTRIBUTE_EMAIL = 'email';
diff --git a/docs/references/storage/get-file-preview.md b/docs/references/storage/get-file-preview.md
index a6f4a6186d..415250b802 100644
--- a/docs/references/storage/get-file-preview.md
+++ b/docs/references/storage/get-file-preview.md
@@ -1 +1 @@
-Get a file preview image. Currently, this method supports preview for image files (jpg, png, and gif), other supported formats, like pdf, docs, slides, and spreadsheets, will return the file icon image. You can also pass query string arguments for cutting and resizing your preview image.
\ No newline at end of file
+Get a file preview image. Currently, this method supports preview for image files (jpg, png, and gif), other supported formats, like pdf, docs, slides, and spreadsheets, will return the file icon image. You can also pass query string arguments for cutting and resizing your preview image. We do not support preview for file size above 10MB.
\ No newline at end of file