Hi,
I think, there is a bug in includes/file.inc.
Starting in line 196:
if ($_FILES["files"]["name"][$source] && is_uploaded_file($_FILES["files"]["tmp_name"][$source])) {
// Check for file upload errors and return FALSE if a
// lower level system error occurred.
switch ($_FILES["files"]["error"][$source]) {
// @see http://php.net/manual/en/features.file-upload.errors.php
case UPLOAD_ERR_OK:
break;
case UPLOAD_ERR_INI_SIZE:
case UPLOAD_ERR_FORM_SIZE:
drupal_set_message(t('The file %file could not be saved, because it exceeds the maximum allowed size for uploads.', array('%file' => $source)), 'error');
return 0;
case UPLOAD_ERR_PARTIAL:
case UPLOAD_ERR_NO_FILE:
drupal_set_message(t('The file %file could not be saved, because the upload did not complete.', array('%file' => $source)), 'error');
return 0;
// Unknown error
default:
drupal_set_message(t('The file %file could not be saved. An unknown error has occurred.', array('%file' => $source)),'error');
return 0;
}
The if-clause checks, if there was a file uploaded. If no file was uploaded, then it ommits the following switch-case-block.
But if a file was not uploaded because of a to big filesize, is_uploaded_file() will also return false, as if there was no trying to upload.
That means, that there will be no errormessage.
Solution would be to remove " && is_uploaded_file($_FILES["files"]["tmp_name"][$source])" from the if-part.
Markus
Comments
Comment #1
gdevlugt commentedI believe the call to is_uploaded_file($_FILES["files"]["tmp_name"][$source]) can be safely left out. The $_FILES super global can't be overwritten through injection and would always identify the file as being a valid upload (except if perhaps the filesize is too large, as mentioned by Markus which I haven't yet tested).
Comment #2
dpearcefl commentedConsidering the time elapsed between now and the last comment plus the fact that D5 is no longer supported, I am closing this ticket.
Comment #3
dpearcefl commentedGoing to open this issue until I can confirm it doesn't exist in modern Drupal.
Comment #4
codi commentedold issue and drupal 5 is no longer supported.