Forms with multiple file form elements produce upload errors with the Drupal page cache enabled

These patches worked for me - In this case, as David_Rothstein, suggests do we even need the error message? It seems redundant...

This still works fine in D7. The D8 version needs to be re-rolled. Would be good to get this fixed as we're having to apply this to live sites in D7 right now.

Patch rerolled.

Upgrading priority as this prevents multiple files from being uploaded

In #1489692: Incorrect handling of file upload limit exceeded - file widget disappears it suggests that we do need the check. Maybe we should do a similar check there as in file_save_upload() and instead of deleting the validation code, only run it when any of the files in $_FILES are larger than file_upload_max_size()?

Patch no longer applies.

re-roll of #7

The patch 'works' because you're removing the check. It probably existed for a reason. If the check is bad, we should fix what it does. If the check highlights a file upload problem, we should fix that. Obviously.

The problem I have seems a form build id mismatch, sometimes, on a Webform with several file uploads. Most times, there's no problem. Sometimes there is.

IDs in file upload ajax URLs:

values(Drupal.ajax).map(obj => obj.url).join('\n')

For example:

/en/file/ajax/submitted/kopie_vakkenoverzicht_cijferlijst/form-nPzP0Qn2Vi_uXuCGBnAKj24HBEHVgVIcBTwzaG3MKQY
/en/file/ajax/submitted/kopie_te_waarderen_diploma/form-nPzP0Qn2Vi_uXuCGBnAKj24HBEHVgVIcBTwzaG3MKQY
/en/file/ajax/submitted/kopie_beedigde_vertaling_van_diploma_en_vakkenoverzicht_cijferlijst/form-nPzP0Qn2Vi_uXuCGBnAKj24HBEHVgVIcBTwzaG3MKQY
/en/file/ajax/submitted/kopie_geldig_identiteitsbewijs_van_de_diplomahouder/form-nPzP0Qn2Vi_uXuCGBnAKj24HBEHVgVIcBTwzaG3MKQY

The form's ID:

document.querySelector('#block-system-main [name="form_build_id"]').value

For example:

form-nPzP0Qn2Vi_uXuCGBnAKj24HBEHVgVIcBTwzaG3MKQY

(All 5 are the same, so no problem.)

I still don't know why it does this, but it might help someone.

The multiple part was important, sorry, but the file upload fields was misleading: it happens for file Elements, not Fields.

The upload limit fix might be as simple as removing $form_build_id !== $request_form_build_id from the check... The check should trigger because there's NO data in the request, not because the id is different. The id being different must have another reason. It'd still be good to find and fix that reason of course.

I've fixed it on my website by disabling page cache for webforms, which Field seems to do too (I couldn't reproduce the error on a node form, but easily on a webform).

We are experiencing this issue after migrating to a different hosting environment. I am just putting this here to trigger ideas. I don't know what changed between environments. If I do figure it out I will post back.

We applied the patch in #1 but not to file_ajax_upload but media_ajax_upload and while it does get rid of that error I am still pursuing a deeper fix.

Now using the proper media tag. Sorry.

Experiencing this issue in D7.
When the buildId of the form is updated, the ajax path for uploading a file is not updatet to the correct buildid.

Eg. files are uploaded to /file/ajax/uploadfield/form-OLDBUILD id instead of /file/ajax/uploadfield/form-NEWBUILDID

This is fixed by updating the JS settings of the form when the buildId is updatet. This will include the correct AJAX upload path.

    // Update the form settings (eg. for upload fields).
    $output = drupal_render($form);
    $js = drupal_add_js();
    $settings = drupal_array_merge_deep_array($js['settings']['data']);
    $commands[] = ajax_command_replace(NULL, $output, $settings);

Hi @sjerdo : I experienced the same issue.

Where (on which file) do I need to apply your patch ?

Moving this issue back to D7 since this presumably has been resolved for D8 in issue #2500527: Rewrite \Drupal\file\Controller\FileWidgetAjaxController::upload() to not rely on form cache, since D8 no longer contains the form_build_id in the URL for file uploads.

D7 still contains this bug when the form contains one or more AJAX elements of which one is a file upload field.

Update for D7.59

#37 has resolved our issue; thanks!

In our case, we had just started using Authcache for anonymous users, not Drupal cache. However the behavior we observed was the same as described here (first file upload works fine but changes the form build id, subsequent file upload requests hit the old build id and throw an error).

So, we applied the patch in #37 and found it works for us.

I'm trying to reproduce this issue on a mostly vanilla Drupal 7.81 site (only admin_menu installed, for ease of navigation). The issue summary says:

With Drupal's page cache enabled and more than one file upload field on a form, uploading to the first via the "Upload" button and then trying the same for the second produces an erroneous "the uploaded file likely exceeded the maximum file size" error message.

Based on that, I've done the following:

1. Navigate to admin/config/development/performance
2. enable page and block cache
3. set cache lifetime/expiration to 15min/1hr respectively
4. enable all "Bandwidth optimization" options
5. save configuration
6. head to admin/structure/types/manage/article/fields
7. add a "another image" field of type image (leave all settings as defaults)
8. save settings
9. start creating a node of type "Article"
10. add title
11. select an image for the first field
12. click the "Upload" button -> all good, no errors 👍
13. select another image for the second field
14. click the "Upload" button -> all good, no errors 👍
15. save the node -> all good, no errors 👍

What am I missing in order to reproduce this?

klonos, I've noticed the issue can be illusive to reproduce. The key seems to be in the browser cookies. I've been able to reliably reproduce the issue by following the a couple steps.

First, you need to be logged out to test the issue. Then, clear your browser cookies. As an anonymous user, fill out the form. Upload the first file should work with no issues. The second, third, etc. should trigger the error.

Assuming the error triggered for you, try reloading the form and fill out the form again. This time the multiple file uploads should all work, misleading you into thinking the issue resolved itself which is not true. The key difference is in two session cookies that are created after the first file upload, plus a subsequent page reload. As long as those cookies are present, the multiple file uploads continues to work. Clear those cookies and the issue returns.

I'm not sure if this is a side effect of the form_build_id issue, or a root cause. I'm still investigating.

Reroll for #37. Update for 7.93

Aside from the two failures which are caused by the new tests, this is unlikely to be committed in this form (see #19, #22, #39, #40).

Removing the check is "nice", but it does not solve the problem (or problems), it will only hide the problem. Without this check, the form with an empty $_POST data will fail silently and I think it is the same than the current state.

I saw this error personally when the whole $_POST data were empty and this triggered the error, not the mismatch of the form_build_ids. So it would be nice to find the root cause here, or if there are multiple root causes combined, then rescope this issue summary.

Also there are some related comments for this in #2749245: Back port: Incorrect handling of file upload limit exceeded - file widget disappears, in comments #8 and #9.

Maybe we can try the approach from #2787243: Multiple AJAX File uploads in one form breaks for anonymous user.