The maxRequestLength parameter configured in the web.config file can be used as a comparison to limit the maximum uploaded file size.
An httpRuntime entry taken from a web.config file, showing the parameter maxRequestLength
<httpRuntime shutdownTimeout="120" exectionTimeout="900" useFullyQualifiedRedirectUrl="true" maxRequestLength="16384" requestLengthDiskThreshold="16384" requestValidationMode="2.0" />
The parameter is accessed through the httpRuntimeSection class.
Dim cfHRS as System.Web.Configuration.HttpRuntimeSection = System.Configuration.Configurationmanager.GetSection("system.web/httpRuntime")
The maxRequestLength parameter, cfHRS.MatRequestLength is then used as a comparison with the uploaded file’s ContentLength value, giving:
If uploadedFile.ContentLength > cfHRS.MaxRequestLength *1000 then Return "errFileSize: " & uploadedFile.ContentLength End if
Accessing the parameter from the web.config file has a number of advantages:
- Allows a single point of reference.
- If the site should be moved to a different server, or the package installed to a different installation then it will adopt the local configuration without additional parameter setting.
- Ensures that the configuration of the module doesn’t have a value which is greater than the website configured value, which will result in an error on uploading of an image which exceeds the web.config value.
- limiting the upload size to a realistic small value will make the site less prone to a denial of service (DOS) attack whereby excessively large images ae uploaded.
