{"record":{"id":"c163cc70f9e8af7b","repo":"Dolibarr/dolibarr","slug":"errorfilesizetoolarge-errorgobackandcorrectparameters","errorCode":null,"errorMessage":"ErrorFileSizeTooLarge ErrorGoBackAndCorrectParameters","messagePattern":"ErrorFileSizeTooLarge ErrorGoBackAndCorrectParameters","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"htdocs/main.inc.php","lineNumber":434,"sourceCode":"\t\t\t$sensitiveget = true;\n\t\t}\n\t}\n\n\t// Check a token is provided for all cases that need a mandatory token\n\t// (all POST actions + all sensitive GET actions + all mass actions + all login/actions/logout on pages with CSRFCHECK_WITH_TOKEN set)\n\tif (\n\t\t(!empty($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') ||\n\t\t$sensitiveget ||\n\t\tGETPOSTISSET('massaction') ||\n\t\t((GETPOSTISSET('actionlogin') || GETPOSTISSET('action')) && defined('CSRFCHECK_WITH_TOKEN'))\n\t) {\n\t\t// If token is not provided or empty, error (we are in case it is mandatory)\n\t\tif (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') {\n\t\t\ttop_httphead();\n\t\t\tif (GETPOSTINT('uploadform')) {\n\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused. File size too large or not provided.\");\n\t\t\t\t$langs->loadLangs(array(\"errors\", \"install\"));\n\t\t\t\tprint $langs->trans(\"ErrorFileSizeTooLarge\").' ';\n\t\t\t\tprint $langs->trans(\"ErrorGoBackAndCorrectParameters\");\n\t\t\t} else {\n\t\t\t\thttp_response_code(403);\n\t\t\t\tif (defined('CSRFCHECK_WITH_TOKEN')) {\n\t\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused by CSRF protection (CSRFCHECK_WITH_TOKEN protection) in main.inc.php. Token not provided.\", LOG_WARNING);\n\t\t\t\t\tprint \"Access to a page that needs a token (constant CSRFCHECK_WITH_TOKEN is defined) is refused by CSRF protection in main.inc.php. Token not provided.\\n\";\n\t\t\t\t} else {\n\t\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused by CSRF protection (POST method or GET with a sensible value for 'action' parameter) in main.inc.php. Token not provided.\", LOG_WARNING);\n\t\t\t\t\tprint \"Access to this page this way (POST method or GET with a sensible value for 'action' parameter) is refused by CSRF protection in main.inc.php. Token not provided.\\n\";\n\t\t\t\t\tprint \"If you access your server behind a proxy using url rewriting and the parameter is provided by caller, you might check that all HTTP header are propagated (or add the line \\$dolibarr_nocsrfcheck=1 into your conf.php file or MAIN_SECURITY_CSRF_WITH_TOKEN to 0\";\n\t\t\t\t\tif (getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN')) {\n\t\t\t\t\t\tprint \" instead of \" . getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN');\n\t\t\t\t\t}\n\t\t\t\t\tprint \" into setup).\\n\";\n\t\t\t\t}\n\t\t\t}\n\t\t\tdie;\n\t\t}","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L416-L452","documentation":"This is the token-missing handler in main.inc.php's CSRF protection. When the CSRF token is absent (and not literally 'notrequired') and the request is a large upload (uploadform), Dolibarr assumes the POST exceeded PHP's post_max_size so even the token field was dropped, and reports ErrorFileSizeTooLarge + ErrorGoBackAndCorrectParameters instead of a plain CSRF refusal.","triggerScenarios":"POST/multipart upload where $_POST is empty because Content-Length exceeds post_max_size/upload_max_filesize, so GETPOST('token') is empty; form reached with uploadform flag and no token parameter.","commonSituations":"Uploading a dump/backup bigger than post_max_size; PHP ini limits lowered on new server; Suhosin/proxy stripping the body; forgotten token in a custom upload form.","solutions":["Raise post_max_size and upload_max_filesize in php.ini (and web server body limits) to exceed your upload size","Ensure the form includes the CSRF token (form->formConfirm / getTokenField or newToken())","Retry with a smaller file to confirm it is a size problem"],"exampleFix":"// before (php.ini)\npost_max_size = 2M\nupload_max_filesize = 2M\n// after\npost_max_size = 64M\nupload_max_filesize = 64M","handlingStrategy":"validation","validationCode":"if (isset($_SERVER['CONTENT_LENGTH']) && $_SERVER['CONTENT_LENGTH'] > return_bytes(ini_get('post_max_size'))) { die('File exceeds post_max_size'); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep post_max_size/upload_max_filesize well above your largest expected upload","Always include the token field in upload forms","Check upload_max_filesize, post_max_size and web server client_max_body_size together","Test large uploads after any PHP/server migration"],"tags":["php","dolibarr","csrf","file-upload","limits"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}