<p>We are putting our new Craft CMS 3.2 install (dev environment) through some security scan paces, including uploads of 500Mb files. We'd expect to throw an exception message/error page on an over-the-limit file, but it is not doing that currently (it simply hangs).</p>

<p>When we run these scans against other CMS applications, when the upload is attempted, an error is thrown by the web server and the underlying CMS applications continue to function as they should as do the actual scans. This is not the case when it comes to Craft.</p>

<p>To pass the security scan, we'd like Craft to throw an error, not just 'hang.'</p>

<blockquote>
  <p>If Craft is hanging or timing out while you’re uploading a large file,
  or if you get the error message “The uploaded file is empty”, you’re
  probably running into a limitation imposed by your server’s
  configuration.
  <a href="https://craftcms.com/guides/troubleshooting-unsuccessful-file-uploads" rel="nofollow noreferrer">https://craftcms.com/guides/troubleshooting-unsuccessful-file-uploads</a></p>
</blockquote>

<p>Our PHP Info:<br>
memory_limit    512M;<br>
upload_max_filesize 256M</p>

CC BY-SA 4.0
2019-11-27T21:03:10.720Z
Hi Michael - this sounds like more of a bug or feature request than a question here that someone could answer.  Would you mind posting on https://github.com/craftcms/cms/issues, which is where those types of issues are tracked?
Brad Bell
CC BY-SA 4.0
2019-11-28T00:39:21.563Z
Great suggestion – done!
https://github.com/craftcms/cms/issues/5278
Michael
<upload><security><memory>
Craft CMS security scans: upload of over-the-limit file hangs the system; should it throw exception/error?
# Craft CMS security scans: upload of over-the-limit file hangs the system; should it throw exception/error?

(Asked by: username_0 on 2019-11-27)

We are putting our new Craft CMS 3.2 install (dev environment) through some security scan paces, including uploads of 500Mb files. We'd expect to throw an exception message/error page on an over-the-limit file, but it is not doing that currently (it simply hangs).

When we run these scans against other CMS applications, when the upload is attempted, an error is thrown by the web server and the underlying CMS applications continue to function as they should as do the actual scans. This is not the case when it comes to Craft.

To pass the security scan, we'd like Craft to throw an error, not just 'hang.'

> If Craft is hanging or timing out while you’re uploading a large file,
> or if you get the error message “The uploaded file is empty”, you’re
> probably running into a limitation imposed by your server’s
> configuration.
> <https://craftcms.com/guides/troubleshooting-unsuccessful-file-uploads>

Our PHP Info:  
memory\_limit 512M;  
upload\_max\_filesize 256M

**Tags:** upload, security, memory

> **Comments:**
> **username_1**: Hi username_0 - this sounds like more of a bug or feature request than a question here that someone could answer.  Would you mind posting on https://github.com/craftcms/cms/issues, which is where those types of issues are tracked?  
> **username_0**: Great suggestion – done! https://github.com/craftcms/cms/issues/5278  

---

## 0 answers

