From 7f859910090859ec3dcf90d28c933abd9de92927 Mon Sep 17 00:00:00 2001 From: Claudio Costa Date: Wed, 7 Oct 2020 18:47:36 +0200 Subject: [PATCH] Fix possible inconsistencies (#15770) --- app/upload.go | 8 ++++++++ app/upload_test.go | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/app/upload.go b/app/upload.go index b2faa21171..6531112a9a 100644 --- a/app/upload.go +++ b/app/upload.go @@ -98,6 +98,14 @@ func (a *App) UploadData(us *model.UploadSession, rd io.Reader) (*model.FileInfo a.Srv().uploadLockMapMut.Unlock() }() + // fetch the session from store to check for inconsistencies. + if storedSession, err := a.GetUploadSession(us.Id); err != nil { + return nil, err + } else if us.FileOffset != storedSession.FileOffset { + return nil, model.NewAppError("UploadData", "app.upload.upload_data.concurrent.app_error", + nil, "FileOffset mismatch", http.StatusBadRequest) + } + // make sure it's not possible to upload more data than what is expected. lr := &io.LimitedReader{ R: rd, diff --git a/app/upload_test.go b/app/upload_test.go index 1cd00b1324..807b415200 100644 --- a/app/upload_test.go +++ b/app/upload_test.go @@ -278,6 +278,7 @@ func TestUploadDataConcurrent(t *testing.T) { // Verify that only 1 request was able to perform the upload. require.Equal(t, int32(n-1), nErrs) + nErrs = 0 wg.Add(n) @@ -300,7 +301,7 @@ func TestUploadDataConcurrent(t *testing.T) { wg.Wait() // Verify that only 1 request was able to finish the upload. - require.Equal(t, int32(n*2-2), nErrs) + require.Equal(t, int32(n-1), nErrs) d, err := th.App.ReadFile(us.Path) require.Nil(t, err)