From 7fc2703d90a8f43a40765f1b6b68c7de63083fa1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 7 Feb 2026 19:39:57 +0000
Subject: [PATCH] Increase HTTP request timeout to 120s for large file
 processing (up to 1GB PDFs)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .env.demo                        |  3 ++-
 SECURITY_AUDIT.md                | 11 +++++++++--
 app/config.py                    |  2 +-
 app/tasks/upload_to_nextcloud.py |  2 +-
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.env.demo b/.env.demo
index 4897ad3d..c7b5922f 100644
--- a/.env.demo
+++ b/.env.demo
@@ -138,7 +138,8 @@ SFTP_FOLDER=/Documents/Uploads
 SFTP_DISABLE_HOST_KEY_VERIFICATION=True  # Set to False in production for security
 
 # **HTTP Request Settings**
-HTTP_REQUEST_TIMEOUT=30  # Timeout for HTTP requests in seconds (default: 30)
+# Timeout for HTTP requests - set higher to handle large PDF files (up to 1GB)
+HTTP_REQUEST_TIMEOUT=120  # Timeout in seconds (default: 120 for large file operations)
 
 # **Notification Settings**
 # Configure notification services using Apprise URL format
diff --git a/SECURITY_AUDIT.md b/SECURITY_AUDIT.md
index d65e6188..0db64b18 100644
--- a/SECURITY_AUDIT.md
+++ b/SECURITY_AUDIT.md
@@ -78,9 +78,16 @@ This document tracks security vulnerabilities found in DocuElevate and their rem
 **Issue:** HTTP requests without timeout can hang indefinitely, leading to resource exhaustion and potential DoS.
 
 **Remediation:**
-- Added `http_request_timeout` configuration setting (default: 30 seconds)
+- Added `http_request_timeout` configuration setting (default: 120 seconds)
+- Timeout configured to handle large file operations (PDFs up to 1GB+)
 - Applied `timeout=settings.http_request_timeout` to all `requests.get()`, `requests.post()`, and `requests.put()` calls
-- Configurable via environment variable: `HTTP_REQUEST_TIMEOUT=30`
+- Configurable via environment variable: `HTTP_REQUEST_TIMEOUT=120`
+
+**Note:** The 120-second default timeout is appropriate for:
+- Large PDF file uploads and downloads (up to 1GB)
+- PDF conversion operations via Gotenberg
+- Cloud storage uploads (Dropbox, OneDrive, Google Drive, Nextcloud, WebDAV)
+- Document processing and OCR operations
 
 ### Low Severity Issues (Informational)
 
diff --git a/app/config.py b/app/config.py
index b74cd5ef..5af5473b 100644
--- a/app/config.py
+++ b/app/config.py
@@ -138,7 +138,7 @@ class Settings(BaseSettings):
     uptime_kuma_ping_interval: int = 5  # Default ping interval in minutes
 
     # HTTP request settings
-    http_request_timeout: int = 30  # Default timeout for HTTP requests in seconds
+    http_request_timeout: int = 120  # Default timeout for HTTP requests in seconds (handles large file operations)
 
     # Feature flags
     allow_file_delete: bool = True  # Default to allowing file deletion from database
diff --git a/app/tasks/upload_to_nextcloud.py b/app/tasks/upload_to_nextcloud.py
index 3dd98a22..a6cf98c7 100644
--- a/app/tasks/upload_to_nextcloud.py
+++ b/app/tasks/upload_to_nextcloud.py
@@ -120,7 +120,7 @@ def upload_to_nextcloud(self, file_path: str, file_id: int = None):
                 data=file_data,
                 auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
                 headers={'Content-Type': 'application/octet-stream'},
-                timeout=60  # Longer timeout for larger files
+                timeout=settings.http_request_timeout  # Use configured timeout for large files
             )
         
         if response.status_code in (201, 204):  # Created or No Content