superseriousbusiness / gotosocial

Fast, fun, small ActivityPub server.
https://docs.gotosocial.org
GNU Affero General Public License v3.0
3.66k stars 310 forks source link

[bug] Settings panel: Insufficiently Form submission error handling #2472

Closed Ryuno-Ki closed 3 hours ago

Ryuno-Ki commented 8 months ago

Describe the bug with a clear and concise description of what the bug is.

When I upload a file that is larger than the server can handle, the error message is returning not enough information to understand the problem.

What's your GoToSocial Version?

v0.13.0

GoToSocial Arch

amd64

What happened?

I'm running a Bare Metal GoToSocial behind a NginX reverse proxy. When I log into the profile settings to replace the avatar and pick an image that is larger than the allowed body size, the server responds with 413 Request Entity Too Large.

The settings UI is only showing a Parse Error.

What you expected to happen?

I was expecting a notification, that my image was too large. Since this is a request behind OAuth, no information can leak.

How to reproduce it?

Set up a Go To Social instance. Run it on localhost behind a Nginx reverse proxy. Lower the client_max_body_size to something like 1K (1 kilobyte). Upload an image as avatar larger than this treshold. Notice the error in the User Interface telling you about a Parse Error.

Anything else we need to know?

I've tried to trace down the logic, but don't know about all the moving parts yet (haven't dealt with some of the libraries in use here).

The File Input is in

https://github.com/superseriousbusiness/gotosocial/blob/v0.13.0/web/source/settings/admin/settings/index.jsx

Form submit happens in

https://github.com/superseriousbusiness/gotosocial/blob/v0.13.0/web/source/settings/lib/form/submit.ts

This triggers a mutation in

https://github.com/superseriousbusiness/gotosocial/blob/v0.13.0/web/source/settings/lib/query/admin/index.ts

I cannot say (yet) where error handling is taking place.

tsmethurst commented 8 months ago

Alright thanks, I'll take a look :) Probably a bug I wrote.

tsmethurst commented 3 hours ago

I've now handled this in various PRs since the issue was opened, so should be good now :)