Hi,

I think, there is a bug in includes/file.inc.

Starting in line 196:

if ($_FILES["files"]["name"][$source] && is_uploaded_file($_FILES["files"]["tmp_name"][$source])) {

    // Check for file upload errors and return FALSE if a
    // lower level system error occurred.
    switch ($_FILES["files"]["error"][$source]) {

      // @see http://php.net/manual/en/features.file-upload.errors.php
      case UPLOAD_ERR_OK:
        break;

      case UPLOAD_ERR_INI_SIZE:
      case UPLOAD_ERR_FORM_SIZE:
        drupal_set_message(t('The file %file could not be saved, because it exceeds the maximum allowed size for uploads.', array('%file' => $source)), 'error');
        return 0;

      case UPLOAD_ERR_PARTIAL:
      case UPLOAD_ERR_NO_FILE:
        drupal_set_message(t('The file %file could not be saved, because the upload did not complete.', array('%file' => $source)), 'error');
        return 0;

      // Unknown error
      default:
        drupal_set_message(t('The file %file could not be saved. An unknown error has occurred.', array('%file' => $source)),'error');
        return 0;
    }

The if-clause checks, if there was a file uploaded. If no file was uploaded, then it ommits the following switch-case-block.
But if a file was not uploaded because of a to big filesize, is_uploaded_file() will also return false, as if there was no trying to upload.
That means, that there will be no errormessage.
Solution would be to remove " && is_uploaded_file($_FILES["files"]["tmp_name"][$source])" from the if-part.

Markus

Comments

gdevlugt’s picture

I believe the call to is_uploaded_file($_FILES["files"]["tmp_name"][$source]) can be safely left out. The $_FILES super global can't be overwritten through injection and would always identify the file as being a valid upload (except if perhaps the filesize is too large, as mentioned by Markus which I haven't yet tested).

dpearcefl’s picture

Status: Active » Closed (won't fix)

Considering the time elapsed between now and the last comment plus the fact that D5 is no longer supported, I am closing this ticket.

dpearcefl’s picture

Status: Closed (won't fix) » Postponed

Going to open this issue until I can confirm it doesn't exist in modern Drupal.

codi’s picture

Status: Postponed » Closed (won't fix)

old issue and drupal 5 is no longer supported.