Add per-ticket attachment count/storage quota (#55)

api/upload_attachment.php enforced a per-file size cap but nothing
bounded the total number of attachments on a single ticket or their
cumulative size over time — an authenticated low-privilege user could
slowly fill the uploads/ disk by attaching many files across tickets,
bounded only by the general rate limiter (which throttles request
rate, not storage volume).

Added MAX_ATTACHMENTS_PER_TICKET (50) and
MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET (100MB) config defaults, enforced
before move_uploaded_file() using AttachmentModel::getAttachmentCount()
and getTotalSizeForTicket() — both already existed in the model with
zero callers, apparently added for exactly this purpose but never
wired in.

Verified against a local MariaDB instance: with 3 existing 1MB
attachments and a 3-attachment cap, the count check correctly rejects
a 4th; with a 5MB total cap, a 2.5MB upload that would push the ticket
over the limit is correctly rejected while a small one that fits is
not.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X

This commit is contained in:

jared

2026-09-08 14:14:00 -04:00

co-authored by

Claude Sonnet 5

parent 67d3c13bb6

commit 338bed7eb7

2 changed files with 19 additions and 1 deletions

									
										config/config.php
									
		+2
		
												View File
												
				@@ -115,6 +115,8 @@ $GLOBALS['config'] = [

				    // File upload settings

				    'MAX_UPLOAD_SIZE' => 10485760, // 10MB in bytes

				    'MAX_ATTACHMENTS_PER_TICKET' => 50,

				    'MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET' => 104857600, // 100MB in bytes

				    'ALLOWED_FILE_TYPES' => [

				        'image/jpeg',

				        'image/png',