[jira] Commented: (WW-2073) File upload - maximum size validation does not work; (JakartaMultiPartRequest with struts.multipart.maxSize overrides fileInterceptor.maxsize)

["Dale Newfield (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/struts/browse/WW-2073?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_41895 ] 

Dale Newfield commented on WW-2073:
-----------------------------------

I must admit, I am confused about this myself.

I currently set both struts.multipart.maxSize and the "fileUpload" interceptor's "maximumSize" (different from maxsize ?)

                <interceptor-ref name="fileUpload">
                  <param name="maximumSize">2097152</param><!-- 2MB -->
                  <param name="allowedTypes">image/jpeg,image/pjpeg,application/octet-stream</param><!-- When a file upload field is left empty, firefox sends an empty file of this type - must allow it through the interceptor, but explicitly fail/ignore it (especially if the accompanying file size is non-zero) -->
                </interceptor-ref>

Can I request that the first release including this fix include specific instructions as to what should/should not be set?

> File upload - maximum size validation does not work; (JakartaMultiPartRequest with struts.multipart.maxSize overrides fileInterceptor.maxsize)
> ----------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: WW-2073
>                 URL: https://issues.apache.org/struts/browse/WW-2073
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Interceptors
>    Affects Versions: 2.0.9
>            Reporter: Lukasz Racon
>             Fix For: 2.0.10
>
>
> By adding upload.setSizeMax to JakartaMultiPartRequest (@see https://issues.apache.org/struts/browse/WW-1549), the file upload interceptor max size validation has been disabled. Furthermore, whenever there is a single file above the allowed size none of the request parameters are set on the action This happens due to upload.parseRequest(createRequestContext(servletRequest)) which throws exception (o.a.c.fileupload.FileItemIteratorImpl checks max size).
> If the application requires the parameters it will fail.
> There is also slight confusion and disconnect between:
> struts.multipart.maxSize and fileInterceptor.maxsize
> If you upload file that exceeds allowed struts.multipart.maxSize fileInterceptor will never kick in.
> IMHO file upload interceptor should be responsible for max size validation (esp. that it reports errors as field errors and not as action errors).
> Furthermore, we should drop 'struts.multipart.maxSize' since is confusing along with fileInterceptor.maxsize, also fileInterceptor.maxsize should get a new default max size. The other option is to use struts.multipart.maxSize to set fileInterceptor.maxsize.
> This line should be removed so file interceptor can validate files:
> ------
> Index: src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java
> ===================================================================
> --- src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java (revision 560614)
> +++ src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java (working copy)
> @@ -86,7 +86,6 @@
>          // Parse the request
>          try {
>              ServletFileUpload upload = new ServletFileUpload(fac);
> - upload.setSizeMax(maxSize);
>              List items = upload.parseRequest(createRequestContext(servletRequest));
> -------------- 

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.