From bb490101fd9a67268af099da6ee7764bdf80c01d Mon Sep 17 00:00:00 2001 From: catborise Date: Fri, 6 Nov 2026 19:50:20 +0300 Subject: [PATCH] fix(nginx): a request body is at most 64 MiB Every route accepted a 1 GiB body, and nginx buffers a body to disk before the panel can refuse it: anyone, without an account, could fill that disk with large requests sent slowly and never finished. The one large body is an ISO upload's chunk, 32 MiB (storage_page.js); the limit is now 64 MiB. Checked with nginx and this config: 33 and 64 MiB pass to the panel, 65 MiB is answered 413. --- conf/nginx/webvirtcloud.conf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/conf/nginx/webvirtcloud.conf b/conf/nginx/webvirtcloud.conf index bbe22fbd..6ea2f575 100644 --- a/conf/nginx/webvirtcloud.conf +++ b/conf/nginx/webvirtcloud.conf @@ -29,7 +29,10 @@ server { proxy_connect_timeout 1800; proxy_read_timeout 1800; proxy_send_timeout 1800; - client_max_body_size 1024M; + # an ISO upload sends 32 MiB chunks; nothing else is large. nginx + # buffers a body to disk before the panel sees it: a bigger limit + # lets anyone fill that disk with unfinished requests + client_max_body_size 64M; } location /novncd/ {