Simple Machines Community Forum

SMF Development => Bug Reports => Topic started by: Antechinus on May 24, 2022, 07:57:48 PM

Title: Total attachment size limit can be fooled.
Post by: Antechinus on May 24, 2022, 07:57:48 PM
Test case: limit of 8 attachments per post. Total size limit of 1,920 kB per post.

Upload a single image of 1,810 kB. Then, upload a second copy of the same image (with a different name).

The combination of the first and second copies obviously exceeds the total size limit by 1,700 kb, yet the second copy will be accepted as long as its size is less than the total limit.


That's one bug. There's another, related, bug.

After uploading the previous two images, attempt to upload a third copy. It will not be accepted, because this time the code recognises that it's over the limit, but the language string that notifies you of this incorrectly states that the total of all selected files is 3,693 kB.

That figure does not match either the total of the first two copies (approx. 3,620 kB) or the actual current total (aprox. 5,430 kB).

Furthermore, it states the incorrect figure to a ridiculous number of decimal places, because rounding is not applied in smf_fileUpload.js before the value is echoed to the browser.

Fixing the rounding issue is trivial:
Code (FInd) Select
            // This file has reached the max total size per post.
            if (totalKB > 0 && currentlyUsedKB > totalKB) {
                done(myDropzone.options.text_totalMaxSize.replace('{currentTotal}', totalKB).replace('{currentRemain}', currentlyUsedKB));
Code (Replace) Select
            // This file has reached the max total size per post.
            if (totalKB > 0 && currentlyUsedKB > totalKB) {
                done(myDropzone.options.text_totalMaxSize.replace('{currentTotal}', totalKB).replace('{currentRemain}', Math.round(currentlyUsedKB)));

Screenshot attached, with rounding fixed. At the moment I have no idea about the total limit issue itself :)

(And yes, I know the presentation is not default, but the javascript behind it is. So no, you can't wriggle out of it that way. :P )
Title: Re: Total attachment size limit can be fooled.
Post by: shawnb61 on June 05, 2022, 01:07:28 PM
This one can be reproduced.  Issue logged:
https://github.com/SimpleMachines/SMF/issues/7488