User able to post exceeding maximum length restrictions

Filing this as a bug, feel free to change to support if not the case.

Over at Stonehearth we had a user post a log directly as text in the editor, and was able to submit it. The post exceeds the maximum length allowed significantly, as I tried to edit the post to surround the log in a code block but was not allowed. The post in question was originally here and moved to here where I converted it to a Pastebin link.

The error received stated:

Body is limited to 32000 characters; you entered 2459079.

If it helps troubleshoot, this post likely went through the approval queue as the user is new and we currently have the first 2 posts from each user go into the queue.

4 Likes

Sounds similar to

In the sense, that the Post Approval Queue isn’t validating the post before permitting it. Looks like another change in that area would need to be made so it abides by content length too.

1 Like

This is a bug @eviltrout.

1 Like

It’s honestly a little challenging to validate every little thing, due to the way the queue works. The (perhaps wrong) assumption I made when designing it was that the staff member had to approve it anyway, so the validation was less important.

Having said that, I did manage to get a bunch more validation in place, including the length:

https://github.com/discourse/discourse/commit/2c9a47dda511a15efbf4ee4e92bee0b0f7b07def

7 Likes

Could you call into PostCreator with the ‘in transaction’ flag set, and always rollback, and only queue if PostCreator succeeded?

1 Like

Yes but that would be doing double the work in many cases, just for the sake of validating! The goal is to not build up a graph of extra queries.