Files are uploaded on form validation failure

Found that Webforms will upload files to the server even form validation failure. This is a potential security issue on Webforms with CAPTCHA, especially public Webforms, since malicious scripts can continuously upload files and go over any set limits/quotas. I wrote up a solution, mostly in a separate custom module:

/**
 * Implementation of hook_form_validate
 * Cleans up uploaded files on form validation fail
 * Registered in webform.module's webform_client_form() function
 */
function wfedit_webform_form_file_cleanup($form, &$form_state) {
	if(count(form_get_errors()) > 0) { //form failed validation
		if(isset($form_state['values']['submitted'])) {
			//get all submitted file ids
			$file_ids = array();
			foreach($form_state['values']['submitted'] as $submitted) {
				if(is_array($submitted) && isset($submitted['_fid']) &&
						!empty($submitted['_fid'])) {
					$file_ids[] = $submitted['_fid'];
				}
			}
			
			//delete all submitted files
			foreach($file_ids as $fid) {
				$file = webform_get_file($fid);
				file_delete($file->filepath);
				db_query("DELETE FROM {files} WHERE fid = %d", $fid);
			}
		}
	}
}

In the webform.module file, I added the following to the webform_client_form() function:

$form['#validate'] = array('webform_client_form_validate',
  		//@hack
  		//allows us to manipulate form after webform module validation
  		'wfedit_webform_form_file_cleanup');

This last addition is a hack, of course, since it's added right into the Webform module. Hopefully, if this issue is deemed worthy, it will be pushed down into a patch and update.

The solution was tested on specific forms, and may need more general testing.