{"record":{"id":"964c8c56b73778a4","repo":"nextcloud/server","slug":"vevent-or-vtodo-object-exceeds-eventsizelimit-byt","errorCode":null,"errorMessage":"VEvent or VTodo object exceeds $eventSizeLimit bytes","messagePattern":"VEvent or VTodo object exceeds \\$eventSizeLimit bytes","errorType":"exception","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"apps/dav/lib/CalDAV/Validation/CalDavValidatePlugin.php","lineNumber":36,"sourceCode":"use Sabre\\HTTP\\ResponseInterface;\n\nclass CalDavValidatePlugin extends ServerPlugin {\n\n\tpublic function __construct(\n\t\tprivate IAppConfig $config,\n\t) {\n\t}\n\n\t#[\\Override]\n\tpublic function initialize(Server $server): void {\n\t\t$server->on('beforeMethod:PUT', [$this, 'beforePut']);\n\t}\n\n\tpublic function beforePut(RequestInterface $request, ResponseInterface $response): bool {\n\t\t// evaluate if card size exceeds defined limit\n\t\t$eventSizeLimit = $this->config->getValueInt(Application::APP_ID, 'event_size_limit', 10485760);\n\t\tif ((int)$request->getRawServerValue('CONTENT_LENGTH') > $eventSizeLimit) {\n\t\t\tthrow new Forbidden(\"VEvent or VTodo object exceeds $eventSizeLimit bytes\");\n\t\t}\n\t\t// all tests passed return true\n\t\treturn true;\n\t}\n\n}\n","sourceCodeStart":18,"sourceCodeEnd":43,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/CalDAV/Validation/CalDavValidatePlugin.php#L18-L43","documentation":"CalDavValidatePlugin subscribes to beforeMethod:PUT and rejects any CalDAV PUT whose raw CONTENT_LENGTH header exceeds the dav app setting event_size_limit (default 10485760 bytes = 10 MiB) with a Forbidden exception (HTTP 403). It is a cheap header-based guard that stops oversized VEVENT/VTODO payloads - usually inline ATTACH images or huge property blobs - before they are parsed or stored.","triggerScenarios":"PUT to /remote.php/dav/calendars/<user>/<calendar>/<object>.ics with a Content-Length header greater than dav event_size_limit (default 10 MiB); importing events that contain base64-encoded attachments.","commonSituations":"Events with pasted screenshots encoded inline; migrations from systems that embed attachments inside iCalendar; admins who lowered event_size_limit; clients adding very large custom X- properties.","solutions":["Raise the limit: occ config:app:set dav event_size_limit --value='20971520' (bytes), then verify with occ config:app:get dav event_size_limit","Strip inline ATTACH data or replace it with a file link before PUT","Check the serialized event size client-side before uploading and warn the user","Confirm the request hits the instance whose config you changed - the setting is per dav app on that server"],"exampleFix":"# before\nPUT /remote.php/dav/calendars/alice/personal/abc.ics   (Content-Length: 12000000)\n-> 403 VEvent or VTodo object exceeds 10485760 bytes\n\n# after\nocc config:app:set dav event_size_limit --value='20971520'\nPUT /remote.php/dav/calendars/alice/personal/abc.ics   -> 204 No Content","handlingStrategy":"validation","validationCode":"// client-side pre-check before PUT (server default 10 MiB)\n$limit = 10485760; // keep in sync with dav event_size_limit\nif (strlen($icsData) > $limit) {\n    throw new PayloadTooLargeError('event is ' . strlen($icsData) . \" bytes, limit {$limit}\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    $client->request('PUT', $objectUrl, $icsData);\n} catch (\\Sabre\\HTTP\\ClientHttpException $e) {\n    if ($e->getResponse()->getStatus() === 403 && str_contains($e->getMessage(), 'exceeds')) {\n        // strip ATTACH data or ask the admin to raise dav event_size_limit\n    }\n}","preventionTips":["Keep inline attachments out of iCalendar; link files instead","Pre-check the serialized event size before PUT (default limit is 10 MiB)","Remember the limit is the dav app config event_size_limit, adjustable via occ config:app:set dav event_size_limit"],"tags":["caldav","dav","http-403","size-limit","put"],"backgroundTag":"request-body-too-large","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}