Problem/Motivation

The validateManagedFileLimit() method in WebformManagedFileBase only validates file upload limits when the request wrapper format is one of drupal_ajax, drupal_modal, or drupal_dialog.

However, during managed file uploads it is possible for the request URL to contain duplicate _wrapper_format query parameters, for example:

?ajax_form=1&_wrapper_format=html&_wrapper_format=drupal_ajax

In this situation, Symfony's Request::get() returns the first value (html), causing the validation to be skipped even though the request is actually an AJAX upload.

This issue is already acknowledged elsewhere in the Webform codebase (see WebformComputedBase, which contains a workaround for duplicate _wrapper_format parameters), but the same logic is not applied in validateManagedFileLimit().

Steps to reproduce

  1. Create a Webform with a managed file element.
  2. Configure a global file upload limit.
  3. Upload enough files to exceed the configured limit.
  4. When the upload request contains both _wrapper_format=html and _wrapper_format=drupal_ajax, the limit validation is skipped.

Proposed resolution

Reuse the same approach already implemented in WebformComputedBase to detect AJAX requests when duplicate _wrapper_format query parameters are present, instead of relying solely on:

$request->get(MainContentViewSubscriber::WRAPPER_FORMAT)

This ensures that managed file upload limits are correctly validated even when the request URL contains multiple _wrapper_format parameters.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork webform-3607384

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

quentin massez created an issue. See original summary.

liam morland’s picture

Version: 6.3.0-beta6 » 6.3.x-dev
Status: Active » Needs work

Thanks for the patch. Tests are not passing.