[jira] [Commented] (WW-3025) Parameters get lost when file upload over max size allowed

["Maurizio Cucchiara (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WW-3025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13052966#comment-13052966 ] 

Maurizio Cucchiara commented on WW-3025:
----------------------------------------

Unfortunately commons-fileupload throws away every request that exceeds the size limit, as a result, struts loses any chance to recovery the request parameters. 
I strongly recommend to use the maximumSize parameter of the fileupload interceptor [1]:

<action name="doUpload" class="com.example.UploadAction">
     <interceptor-ref name="fileUpload">
         <param name="maximumSize">100</param>
    </interceptor-ref>
    <interceptor-ref name="basicStack"/>
    <interceptor-ref name="workflow"/>

     <result name="input">upload.jsp</result>
    <result name="success">good_result.jsp</result>
</action>

I also suggest to include workflow interceptor to the interceptor stack, such that it yield the input result.
 
[1] http://struts.apache.org/2.2.3/docs/file-upload-interceptor.html

> Parameters get lost when file upload over max size allowed
> ----------------------------------------------------------
>
>                 Key: WW-3025
>                 URL: https://issues.apache.org/jira/browse/WW-3025
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core Interceptors
>    Affects Versions: 2.1.6
>         Environment: All
>            Reporter: Tom Nguyen
>             Fix For: 2.2.x, 2.3
>
>
> When the uploaded file gets rejected because it's content, size, or because of a general problem an Exception is thrown by the MultiPartRequest class. Exceptions are: InvalidContentTypeException, UnknownSizeException, SizeLimitExceededException, and FileUploadException. This can lead to serious problems within the application because the other parameters from the upload form get lost. Happening in a profile page for example means that the user data is lost this can lead to a security Exception. In other case this usually just involves a OGNL-Exception. Meaning your field data like personal file name is lost. Workaround found in http://henning.kropponline.de/index.php/2009/01/18/struts2-fileuploadbase-exception/, but the the still keep uploading to server, not secured.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira