Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 292920

Insufficient validation of the max upload file size field

$
0
0

Problem/Motivation

Maximum upload size is always passing validation.

Values entered to "maximum upload size" must be able to be parsed by Bytes::toInt()

Values larger than the "max_post_size" setting in php.ini are allowed.
So are random strings like "banana" for that matter.

Proposed resolution

Write tests!!

This issue was opened as "values greater than php.ini's limit are allowed.
Having written tests, it's now clear that validation was fundamentally broken.

Add actual validating code to the validator rather than relying on Bytes::toInt() to not do that for us.

Remaining tasks

Fix validation

Deside how to handle vlaues larger than php.ini's max post size.

User interface changes

The maximum upload size field will be more strictly validated and present form errors on invalid data.


Viewing all articles
Browse latest Browse all 292920

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>