getgrav / getgrav/grav-plugin-admin

Misleading error message

Open
#1,494 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

[I ran into a problem](https://github.com/getgrav/grav/pull/2121) where the error message was quite unhelpful. [Here](https://github.com/getgrav/grav-plugin-admin/blob/b77d0e6053fd432eb59a5cd2ed503ab64d1f90b6/classes/adminbasecontroller.php#L138) is the specific code:

```
protected function validateNonce()
{
if (strtolower($_SERVER['REQUEST_METHOD']) === 'post') {
if (isset($this->post['admin-nonce'])) {
$nonce = $this->post['admin-nonce'];
} else {
$nonce = $this->grav['uri']->param('admin-nonce');
}

if (!$nonce || !Utils::verifyNonce($nonce, 'admin-form')) {
if ($this->task === 'addmedia') {

$message = sprintf($this->admin->translate('PLUGIN_ADMIN.FILE_TOO_LARGE', null),
ini_get('post_max_size'));
[...]
```

It seems to me that the function is not related to the file size of uploaded images. We don't check the file size . What we really check is if the nonce (token) is valid or not. Why is there an extra condition for the `addmedia` task? Is this intentional?

Contributor guide

Open the contributing guide

Research direction

Start in classes/adminbasecontroller.php at validateNonce(), especially the addmedia branch and its call to Utils::verifyNonce(). Trace how the admin-nonce is obtained and how FILE_TOO_LARGE is presented. Done means clarifying whether the addmedia condition is intentional and correcting the misleading message or behavior, with the relevant validation flow still covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.