Uploaded image for project: 'ZK'
  1. ZK
  2. ZK-3276

Fileupload size limit can be overridden from the client side

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 8.0.2
    • Fix Version/s: 8.0.3
    • Component/s: Components
    • Security Level: Jimmy
    • Labels:
    • gh.sprint.customfield.default.name:
      ZK 8.0.3 S7, ZK 8.0.3 S9

      Description

      steps to reproduce

      run the attached file fileupload-clientside-override.zul
      try to upload files larger 1KB ... upload fails exceeding limit (OK)
      press the button

      actual result

      uploading files up to 1MB are possible after manipulating the client side widget

      expected result

      even when manipulating the client side the server side should still reject files above the configured limit

      debug info

      when initiating the upload the client sends the max size to the server, which should not be necessary, this information is available at server side anyway (there's no need to send it to the server)

      upload?uuid=fS3Q1&dtid=z_j4d&sid=0&maxsize=1024
      dropupload?uuid=fS3Q6&dtid=z_j4d&maxsize=1024&native=false

      root cause

      the max size param sent from the client side is used without further checking (instead of using the value present at server side)
      https://github.com/zkoss/zk/blob/078307514bfda61f759a051203530df201006b89/zk/src/org/zkoss/zk/au/http/AuUploader.java#L421-L427
      https://github.com/zkoss/zk/blob/078307514bfda61f759a051203530df201006b89/zk/src/org/zkoss/zk/au/http/AuDropUploader.java#L326-L333

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              DevChu DevChu
              Reporter:
              cor3000 cor3000
              Votes:
              2 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours
                  4h