Fixed member able to bypass attachment limit (when dragging files into the editor)

Mr Lucky

Well-known member
I had max attachments in messages set to 5, but a member managed to make a post with 16 attachments.

I then reset the options to 2, and tested it I was only able to upload 2 in a test message.

Is there some setting elsewhere that could have overridden this?
 
Is there some setting elsewhere that could have overridden this?
Have you checked to see if the message was edited and additional images added to it each time? I'm not sure if the limit is applied for edits if there are already existing images in it.
 
I had max attachments in messages set to 5, but a member managed to make a post with 16 attachments.

I then reset the options to 2, and tested it I was only able to upload 2 in a test message.

Is there some setting elsewhere that could have overridden this?
Is this person part of another usergroup that may have elevated attachment privileges?
 
Is this person part of another usergroup that may have elevated attachment privileges?
User group permissions only determine whether or not a user can upload attachments. The number of attachments in a post is a global option in Options > Attachments.
 
Have you checked to see if the message was edited and additional images added to it each time?

The message was not edited, however if it was then you should still get an error message when trying to exceed the limit, ie editing is not a method that can bypass the rules set.

Is this person part of another usergroup that may have elevated attachment privileges?

There are no elevated attachment privileges related to number of attachments in a post. Usergroup permissions do not cover number of attachments. Well I can't find any such permission anyway but I'm asking in case there could be something lurking elsewhere that might override what is in Options > Attachments

Locally hosted ?

I'm not quite sure what you mean. I was under the impression that all attachments go into your xenforo attachment folder (data or internal data)

User group permissions only determine whether or not a user can upload attachments. The number of attachments in a post is a global option in Options > Attachments.

yes, this is exactly why I am confused as I'm not aware of any other place there could be such a permission. My test member with exact same usergroups cannot exceed the limit so I am quite perplexed about how this happened.

The post contains nothing but uploaded attachments

Code:
[ATTACH=full]7953[/ATTACH] [ATTACH=full]7954[/ATTACH] [ATTACH=full]7955[/ATTACH] [ATTACH=full]7956[/ATTACH] [ATTACH]7957[/ATTACH] [ATTACH]7953[/ATTACH] [ATTACH]7954[/ATTACH] [ATTACH]7955[/ATTACH] [ATTACH]7956[/ATTACH] [ATTACH]7957[/ATTACH] [ATTACH]7953[/ATTACH] [ATTACH]7953[/ATTACH] [ATTACH]7954[/ATTACH] [ATTACH]7955[/ATTACH] [ATTACH]7956[/ATTACH] [ATTACH]7957[/ATTACH]
 
Do you have any add-ons that may affect posts and/or attachments in some way?

No, but so far I have not been able to reproduce the issue, so even disabling all addons isn't going to tell me anything.

I have tried a test member same usergroups, attempted to upload more after edit, tried drag and drop and it is all working as expected - the error notice pops up when it should.
 
The post contains nothing but uploaded attachments

Code:
[ATTACH=full]7953[/ATTACH] [ATTACH=full]7954[/ATTACH] [ATTACH=full]7955[/ATTACH] [ATTACH=full]7956[/ATTACH] [ATTACH]7957[/ATTACH] [ATTACH]7953[/ATTACH] [ATTACH]7954[/ATTACH] [ATTACH]7955[/ATTACH] [ATTACH]7956[/ATT
Are all of these attachments actually visible inside the post (either by thumbnail or the full image) or are some of them merely a link e.g. "View attachment 79566"
 
As far as I can work out, the only way this might have happened is if the user posted several posts with the attachments and then a moderator came along and merged them together. That would be logged in the "Moderator Actions" log though in the Thread Tools.
 
As far as I can work out, the only way this might have happened is if the user posted several posts with the attachments and then a moderator came along and merged them together. That would be logged in the "Moderator Actions" log though in the Thread Tools.

Just checked, nothing in the moderator log re: that thread at all.
 
But it's not something you've been able to reproduce since?

Presumably you can't upload more than X images when creating the post, but what if you save the message, edit (and then go to More Options) and then try to add more, does that allow them through? (It shouldn't, and doesn't in my testing). That said, if it was done this way then the post would have a "History" link assuming you have post edit history enabled.
 
But it's not something you've been able to reproduce since?

Presumably you can't upload more than X images when creating the post, but what if you save the message, edit (and then go to More Options) and then try to add more, does that allow them through? (It shouldn't, and doesn't in my testing). That said, if it was done this way then the post would have a "History" link assuming you have post edit history enabled.


I tried that in my testing. As expected I could not upload beyond the limit when editing (which is of course the way it should be)

The post has no edit history.

I am going to test again on my test installation with a database from before the post, and log in as that actual member to see what happens.
 
That said, if it was done this way then the post would have a "History" link assuming you have post edit history enabled.
Though doesn't Post Edit history only kick in after 5 minutes (so in theory you can edit a post multiple times in that window and it now show in history)?
 
Though doesn't Post Edit history only kick in after 5 minutes (so in theory you can edit a post multiple times in that window and it now show in history)?
No. Post edit history is always logged, regardless.

The "Last edited by..." only appears after 5 minutes.
 
Top Bottom