Limit a story to 64 KB before HTML Purifier runs.

A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.

publish/post.lib.php

@@ -206,6 +206,10 @@ function validate_data() {
     $validate['title'] = "You have not submitted a title.";
   }
 
+  if (story_too_long($story)) {
+    $validate['story'] = 'The story is too long. Please shorten it.';
+  }
+
   if ($remove_img && !$story) {
     $validate['story'] = "You've tried to remove an image without replacing it with text.";
   }