Limit a story to 64 KB before HTML Purifier runs.

A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.

get_data.lib.php

@@ -3,6 +3,13 @@ require_once('open_db.lib.php');
 require_once(__DIR__ . '/lib/purify.inc.php');
 require_once(__DIR__ . '/html.lib.php');
 
+// The longest story HTML, in bytes. HTML Purifier needs seconds for a few megabytes.
+define('MAX_STORY_BYTES', 65536);
+
+function story_too_long($story) {
+  return strlen((string)$story) > MAX_STORY_BYTES;
+}
+
 function display_stories($id = NULL) {
   global $db, $is_admin, $editable, $action;
   if (is_null($id))
@@ -10,17 +17,20 @@ function display_stories($id = NULL) {
   $search = get_search_args();
   $page   = '';
   $nolink = NULL;
+  $posted = FALSE;
 
   if ($action == 'preview') {
     global $file_src;
     $date = 'Awaiting posting';
     $result = get_post_data(TRUE);
     $nolink = TRUE;
+    $posted = TRUE;
   } else if ($action == 'submit') {
     $date = 'Posted '.gmdate("Y-m-d H:i");
     if (!$is_admin) {
       $result = get_post_data(TRUE);
       $nolink = TRUE;
+      $posted = TRUE;
     } else {
       $result = get_query($id);
     }
@@ -90,6 +100,8 @@ date("Y-m-d H:i", strtotime($entry['date'])) . '</time>';
       } else {
         $page .= '<img src="/display?id='.$entry_id.'" alt="'.$title.'" />';
       }
+    } else if ($posted && story_too_long($entry['story'])) {
+      $page .= '<p>The story is too long to show.</p>'."\n";
     } else {
       $page .= purify_story($entry['story'])."\n";
     }