Problem/Motivation

Upgrade to 6.3.1(security update), a Webform with a file upload field loses file on submit for anonymous and shows error "The uploaded file is invalid"

Steps to reproduce

  1. Use a webform with a managed_file element
  2. Upload a file, submit webform
  3. You'll get "The uploaded file is invalid" — the file is cleared

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comments

priyankampatil created an issue. See original summary.

priyankampatil’s picture

priyankampatil commented
Issue summary: View changes
liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Version: 6.3.1 » 6.3.x-dev

Is this a duplicate of #3625496: Managed file valueCallback() rejects a draft's own previously uploaded files, forcing re-upload on resume?

priyankampatil’s picture

priyankampatil commented

No, this is a completely different scenario. In our case, an anonymous user is unable to submit a webform containing a managed file field and receives “The uploaded file is invalid” error, whereas an authenticated user can successfully submit the same form with the same file field. This issue is not related to resuming a draft or re-uploading a previously uploaded file.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented

Is this new between 6.3.0 and 6.3.1? Can you use git bisect to figure out which commit caused the problem?

cilefen’s picture

cilefen commented
Status: Active » Postponed (maintainer needs more info)
Issue tags: +Possible duplicate

This looks like another report of #3619282: Upgrade to 11.4.5, a Webform with a file upload field loses file on submit for anonymous from the same contributor.

priyankampatil’s picture

priyankampatil commented

Similar issue of file getting removed on webform submit caused by webform update from 6.3.0 to 6.3.1. #3619282: Upgrade to 11.4.5, a Webform with a file upload field loses file on submit for anonymous issue got resolved by reverting #3593472: Insecure Direct Object Reference in Private File Uploads code.