Home » HTML » HTML_QuickForm » Bug #2470

[2004-10-06 15:57 UTC] webrodboulot at hotmail dot com

Description:
------------
Consider this:
- you add a rule to not exceed 50Ko when uploading a file
- you use the setMaxFileSize function to not exceed 50Ko

You upload a file bigger than 50Ko.
The file is not uploaded and the $files->isUploadedFile() return false because of the size of the file.
This is OK.
But the error msg associated to the rule is not displayed beside the file field.
You need to manually get the error number and display an error message on the top of the form.

Reproduce code:
---------------
$form = new HTML_QuickForm('frm', 'post');
$files =& $form->addElement('file', 'newPhoto', "Photo");

$form->addRule('newPhoto', 'File too big(max 50Ko) ', 'maxfilesize', 50000);

$form->setMaxFileSize(50000);
$buttons[] = &HTML_QuickForm::createElement('submit', 'btnSubmit', 'Save');
$form->addGroup($buttons, null, null, ' ');

if ($form->validate()){
if ($files->isUploadedFile()){
//ok
}
else {//ko}
}
$form->display()

Expected result:
----------------
The error message:
too big(max 50Ko)
should be displayed beside the field "newPhoto" as expected!

$form->validate()) should return FALSE because the rule fails.

Actual result:
--------------
No error message is displayed.
$form->validate() return TRUE

files->isUploadedFile() returns FALSE, thiks is OK, but it's too late!

[2004-10-06 16:17 UTC] webrodboulot at hotmail dot com

the workaround I have found:
You set the MaxFileSize function with a VERY VERY BIG number:
$form->setMaxFileSize(5000000000);

This way, if the file is:
- smaller than 50Ko, everything is OK, the file is uploaded
- bigger than 50Ko and smaller than 5000000000Ko, the file is not uploaded and the error message is displayed (GOOD)
- bigger than 5000000000Ko, the file is not uploaded but no error message (this is the bug again).

As nobody is supposed to upload a file bigger than 5000000000Ko, this is a good workaround.
BUT, the main issue is that the file IS always uploaded in the TEMP folder (server side) before the file is rejected or not and the error message is displayed.
So if a malicious person try to upload a big big file, your server can have some problems!!

Another thing, Quickform version is:
QuickForm.php,v 1.139 2004/03/20 11:23:10 avb Exp

[2004-10-07 07:30 UTC] webrodboulot at hotmail dot com

Here is how to fix the bug!
This is due to a wrong code in the _ruleCheckMaxFileSize.
Replace true by false within this function:
function _ruleCheckMaxFileSize($elementValue, $maxSize)
{
if (!HTML_QuickForm_file::_ruleIsUploadedFile($elementValue)) {
return true;
}
return ($maxSize >= @filesize($elementValue['tmp_name']));
}

with:
function _ruleCheckMaxFileSize($elementValue, $maxSize)
{
if (!HTML_QuickForm_file::_ruleIsUploadedFile($elementValue)) {
return false;
}
return ($maxSize >= @filesize($elementValue['tmp_name']));
}

If the file has not been uploaded, it should return false, if the file has been uploaded it sould test if the file is bigger than the max_file_size.
I tested it and it works fine.

Here is the scenario:
- you add a rule to not exceed 50Ko when uploading a file
- you use the setMaxFileSize function to not exceed 50Ko

Now you test it.If the file is:
- smaller than 50Ko, everything is OK, the file is uploaded
- bigger than 50Ko the file is not
uploaded and the error message is displayed (GOOD)!!!!