Download image in chunks and limit size even if the server has no

content-lenght or lies

boards/forms.py

@@ -39,6 +39,10 b" LABEL_SEARCH = _('Search')"
 
 TAG_MAX_LENGTH = 20
 
+IMAGE_DOWNLOAD_CHUNK_BYTES = 100000
+
+HTTP_RESULT_OK = 200
+
 
 class FormatPanel(forms.Textarea):
     """
@@ -250,7 +254,6 b' class PostForm(NeboardForm):'
             content_type = response_head.headers['content-type']
             if content_type in CONTENT_TYPE_IMAGE:
                 length_header = response_head.headers.get('content-length')
-                # TODO Do something if there is no such header
                 if length_header:
                     length = int(length_header)
                     if length > board_settings.MAX_IMAGE_SIZE:
@@ -259,20 +262,28 b' class PostForm(NeboardForm):'
                             % str(board_settings.MAX_IMAGE_SIZE))
 
                 # Get the actual content into memory
-                response = requests.get(url, verify=False)
+                response = requests.get(url, verify=False, stream=True)
 
-                if response.status_code == 200:
-                    content = response.content
+                # Download image, stop if the size exceeds limit
+                size = 0
+                content = b''
+                for chunk in response.iter_content(IMAGE_DOWNLOAD_CHUNK_BYTES):
+                    size += len(chunk)
+                    if size > board_settings.MAX_IMAGE_SIZE:
+                        # TODO Dedup this code into a method
+                        raise forms.ValidationError(
+                            _('Image must be less than %s bytes')
+                            % str(board_settings.MAX_IMAGE_SIZE))
+                    content += chunk
 
+                if response.status_code == HTTP_RESULT_OK and content:
                     # Set a dummy file name that will be replaced
                     # anyway, just keep the valid extension
                     filename = 'image.' + content_type.split('/')[1]
                     img_temp = SimpleUploadedFile(filename, content,
                                                   content_type)
         except Exception:
-            # Just return non image
-            import traceback
-            traceback.print_exc()
+            # Just return no image
             pass
 
         return img_temp