properly close file in error handling of saveConfig and saveBlob (#385)

changelog/unreleased/pull-385

@@ -0,0 +1,7 @@
+Bugfix: Clean up uploads that exceed the repository size limit
+
+An upload that would exceed the repository size limit set with `--max-size`
+leaked a file descriptor and left a temporary file behind. Rest-server now
+closes that file and removes the temporary file.
+
+https://github.com/restic/rest-server/pull/385

repo/repo.go

@@ -315,6 +315,7 @@ func (h *Handler) saveConfig(w http.ResponseWriter, r *http.Request) {
 
 	_, err = io.Copy(f, r.Body)
 	if err != nil {
+		_ = f.Close()
 		h.internalServerError(w, err)
 		return
 	}
@@ -589,6 +590,8 @@ func (h *Handler) saveBlob(w http.ResponseWriter, r *http.Request) {
 	// ensure this blob does not put us over the quota size limit (if there is one)
 	outFile, errCode, err := h.wrapFileWriter(r, tf)
 	if err != nil {
+		_ = tf.Close()
+		_ = os.Remove(tf.Name())
 		if h.opt.Debug {
 			log.Println(err)
 		}