diff --git a/ansible/roles/horizon/templates/horizon.conf.j2 b/ansible/roles/horizon/templates/horizon.conf.j2 index e526f609f5..b54591e563 100644 --- a/ansible/roles/horizon/templates/horizon.conf.j2 +++ b/ansible/roles/horizon/templates/horizon.conf.j2 @@ -48,6 +48,9 @@ TraceEnable off SSLCertificateFile /etc/horizon/certs/horizon-cert.pem SSLCertificateKeyFile /etc/horizon/certs/horizon-key.pem {% endif %} +{% if horizon_httpd_limitrequestbody is defined %} + LimitRequestBody {{ horizon_httpd_limitrequestbody }} +{% endif %} diff --git a/releasenotes/notes/add-horizon-limitrequestbody-4f79433fa2cf1f6d.yaml b/releasenotes/notes/add-horizon-limitrequestbody-4f79433fa2cf1f6d.yaml new file mode 100644 index 0000000000..7b93905f15 --- /dev/null +++ b/releasenotes/notes/add-horizon-limitrequestbody-4f79433fa2cf1f6d.yaml @@ -0,0 +1,9 @@ +--- +features: + - | + Since CVE-2022-29404 is fixed the default value for the LimitRequestBody + directive in the Apache HTTP Server has been changed from 0 (unlimited) to + 1073741824 (1 GiB). This limits the size of images (for example) uploaded + in Horizon. Now this limit can be configured via + ``horizon_httpd_limitrequestbody``. + `LP#2012588 `__