ErrorFileSizeTooLarge ErrorGoBackAndCorrectParameters

Error message

ErrorFileSizeTooLarge ErrorGoBackAndCorrectParameters

What it means

This is the token-missing handler in main.inc.php's CSRF protection. When the CSRF token is absent (and not literally 'notrequired') and the request is a large upload (uploadform), Dolibarr assumes the POST exceeded PHP's post_max_size so even the token field was dropped, and reports ErrorFileSizeTooLarge + ErrorGoBackAndCorrectParameters instead of a plain CSRF refusal.

Solutions

Raise post_max_size and upload_max_filesize in php.ini (and web server body limits) to exceed your upload size
Ensure the form includes the CSRF token (form->formConfirm / getTokenField or newToken())
Retry with a smaller file to confirm it is a size problem

Example fix

// before (php.ini)
post_max_size = 2M
upload_max_filesize = 2M
// after
post_max_size = 64M
upload_max_filesize = 64M

Defensive patterns

Strategy: validation

Validate before calling

if (isset($_SERVER['CONTENT_LENGTH']) && $_SERVER['CONTENT_LENGTH'] > return_bytes(ini_get('post_max_size'))) { die('File exceeds post_max_size'); }

Prevention

Keep post_max_size/upload_max_filesize well above your largest expected upload
Always include the token field in upload forms
Check upload_max_filesize, post_max_size and web server client_max_body_size together
Test large uploads after any PHP/server migration

When it happens

Trigger: POST/multipart upload where $_POST is empty because Content-Length exceeds post_max_size/upload_max_filesize, so GETPOST('token') is empty; form reached with uploadform flag and no token parameter.

Common situations: Uploading a dump/backup bigger than post_max_size; PHP ini limits lowered on new server; Suhosin/proxy stripping the body; forgotten token in a custom upload form.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/c163cc70f9e8af7b. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/main.inc.php:434

			$sensitiveget = true;
		}
	}

	// Check a token is provided for all cases that need a mandatory token
	// (all POST actions + all sensitive GET actions + all mass actions + all login/actions/logout on pages with CSRFCHECK_WITH_TOKEN set)
	if (
		(!empty($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') ||
		$sensitiveget ||
		GETPOSTISSET('massaction') ||
		((GETPOSTISSET('actionlogin') || GETPOSTISSET('action')) && defined('CSRFCHECK_WITH_TOKEN'))
	) {
		// If token is not provided or empty, error (we are in case it is mandatory)
		if (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') {
			top_httphead();
			if (GETPOSTINT('uploadform')) {
				dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused. File size too large or not provided.");
				$langs->loadLangs(array("errors", "install"));
				print $langs->trans("ErrorFileSizeTooLarge").' ';
				print $langs->trans("ErrorGoBackAndCorrectParameters");
			} else {
				http_response_code(403);
				if (defined('CSRFCHECK_WITH_TOKEN')) {
					dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused by CSRF protection (CSRFCHECK_WITH_TOKEN protection) in main.inc.php. Token not provided.", LOG_WARNING);
					print "Access to a page that needs a token (constant CSRFCHECK_WITH_TOKEN is defined) is refused by CSRF protection in main.inc.php. Token not provided.\n";
				} else {
					dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused by CSRF protection (POST method or GET with a sensible value for 'action' parameter) in main.inc.php. Token not provided.", LOG_WARNING);
					print "Access to this page this way (POST method or GET with a sensible value for 'action' parameter) is refused by CSRF protection in main.inc.php. Token not provided.\n";
					print "If you access your server behind a proxy using url rewriting and the parameter is provided by caller, you might check that all HTTP header are propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file or MAIN_SECURITY_CSRF_WITH_TOKEN to 0";
					if (getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN')) {
						print " instead of " . getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN');
					}
					print " into setup).\n";
				}
			}
			die;
		}

View on GitHub (pinned to 598aa4bdad)