No per-ticket or per-user attachment count/storage quota #55

New Issue

2026-08-31T21:36:21-04:00

jared commented

2026-08-31 21:36:21 -04:00

Severity: Low

api/upload_attachment.php enforces a per-file size cap (MAX_UPLOAD_SIZE, default 10MB) but nothing bounds the total number of attachments on a single ticket or the cumulative disk usage of a user/ticket over time. An authenticated low-privilege user can slowly fill the uploads/ disk by attaching many 10MB files across tickets, bounded only by the general session/IP rate limiter (which throttles request rate, not storage volume).

Fix: Add a soft cap — e.g. max N attachments per ticket, and/or a cumulative-size check before move_uploaded_file() — with a clear error message when exceeded.

**Severity:** Low `api/upload_attachment.php` enforces a per-file size cap (`MAX_UPLOAD_SIZE`, default 10MB) but nothing bounds the total number of attachments on a single ticket or the cumulative disk usage of a user/ticket over time. An authenticated low-privilege user can slowly fill the `uploads/` disk by attaching many 10MB files across tickets, bounded only by the general session/IP rate limiter (which throttles request rate, not storage volume). **Fix:** Add a soft cap — e.g. max N attachments per ticket, and/or a cumulative-size check before `move_uploaded_file()` — with a clear error message when exceeded.

jared added the priority/low security labels 2026-09-08 10:15:46 -04:00

jared referenced this issue from a commit

2026-09-08 14:35:21 -04:00

Add per-ticket attachment count/storage quota (#55)

jared referenced this issue from a commit

2026-09-08 15:39:42 -04:00

Merge development into main: 15-issue triage + fix batch

Sign in to join this conversation.