From affeb4549edf802c05ee9cb402606cdf27f79260 Mon Sep 17 00:00:00 2001
From: Cyperghost <olaf_schmitz_1@t-online.de>
Date: Wed, 19 Jun 2024 12:38:47 +0200
Subject: [PATCH] Add validation of submitted files

---
 .../field/FileProcessorFormField.class.php    | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/wcfsetup/install/files/lib/system/form/builder/field/FileProcessorFormField.class.php b/wcfsetup/install/files/lib/system/form/builder/field/FileProcessorFormField.class.php
index dfd9d1531f..ca4f9428b1 100644
--- a/wcfsetup/install/files/lib/system/form/builder/field/FileProcessorFormField.class.php
+++ b/wcfsetup/install/files/lib/system/form/builder/field/FileProcessorFormField.class.php
@@ -7,6 +7,7 @@ use wcf\data\file\FileList;
 use wcf\data\file\thumbnail\FileThumbnailList;
 use wcf\system\file\processor\FileProcessor;
 use wcf\system\file\processor\IFileProcessor;
+use wcf\system\form\builder\field\validation\FormFieldValidationError;
 use wcf\system\form\builder\TObjectTypeFormNode;
 use wcf\util\ArrayUtil;
 use wcf\util\ImageUtil;
@@ -115,6 +116,8 @@ final class FileProcessorFormField extends AbstractFormField
             if ($file->fileID === $value) {
                 $this->files = [$file];
                 $fileIDs[] = $value;
+            } else {
+                $value = null;
             }
         } else {
             if (!\is_array($value)) {
@@ -126,7 +129,8 @@ final class FileProcessorFormField extends AbstractFormField
             $fileList->readObjects();
             $this->files = $fileList->getObjects();
 
-            $fileIDs = $fileList->getObjectIDs();
+            // remove obsolete file IDs from $value
+            $fileIDs = $value = $fileList->getObjectIDs();
         }
 
         if ($fileIDs !== []) {
@@ -141,6 +145,32 @@ final class FileProcessorFormField extends AbstractFormField
         return parent::value($value);
     }
 
+    #[\Override]
+    public function validate()
+    {
+        if ($this->isRequired() && $this->files === []) {
+            $this->addValidationError(new FormFieldValidationError('empty'));
+        }
+
+        $fileProcessor = $this->getFileProcessor();
+
+        if (\count($this->files) > $fileProcessor->getMaximumCount($this->context)) {
+            $this->addValidationError(
+                new FormFieldValidationError(
+                    'maximumFiles',
+                    'wcf.form.field.fileProcessor.error.maximumFiles',
+                    [
+                        'maximumCount' => $fileProcessor->getMaximumCount($this->context),
+                        'count' => \count($this->files),
+                    ]
+                )
+            );
+        }
+
+        parent::validate();
+    }
+
+
     /**
      * Returns the context for the file processor.
      */
-- 
2.20.1