Added all files validation to the "Uploading multiple files" example.

[nawaik]

When following the multiple files documentation:

​https://docs.djangoproject.com/en/3.0/topics/http/file-uploads/#uploading-multiple-files

If you change:

file_field = forms.FileField(widget=forms.ClearableFileInput(attrs={'multiple': True}))

To:

file_field = forms.ImageField(widget=forms.ClearableFileInput(attrs={'multiple': True}))

The file input field looks like this:

<input type="file" name="file_field" multiple="" accept="image/*" required="" id="id_file_field">

If you do inspect element and remove accept="image/*" so it looks like this:

<input type="file" name="file_field" multiple="" required="" id="id_file_field">

If you then only add 1 .txt file everything works fine and you get an error:

"Upload a valid image. The file you uploaded was either not an image or a corrupted image."

However if you upload multiple .txt files or a mix of images and files nothing gets checked and you are able to upload .txt files in imagefields.

I tried this with a fresh project and was able to reproduce the problem.

This is how it looks in the sqlite db:

id	image	                        post_id
4	products/testnow_copy_2.txt	2

Code I used to recreate the problem:

Models.py

from django.db import models

class Product(models.Model):
    title = models.CharField(max_length=50)

class Images(models.Model):
    post = models.ForeignKey(Product, on_delete=models.CASCADE)
    image = models.ImageField(upload_to='products/')

    def __str__(self):
        return self.post.title

Forms.py

from django import forms

from .models import Product

class MultiPhotoForm(forms.ModelForm):
    file_field = forms.ImageField(widget=forms.ClearableFileInput(attrs={'multiple': True}))

    class Meta:
        model = Product
        fields = ['title']

Views.py

from django.shortcuts import render

from .forms import MultiPhotoForm
from .models import Images, Product

def MultiUploadView(request):
    template_name = 'test.html'

    if request.method == "POST":
        form = MultiPhotoForm(request.POST or None, request.FILES or None)
        files = request.FILES.getlist('file_field')
        if form.is_valid():
            title = form.cleaned_data['title']
            product = Product.objects.create(title = title)
            for i in files:
                Images.objects.create(post=product,image=i)
    else:
        form = MultiPhotoForm()
    return render(request, template_name, {'form': form})

[Mariusz Felisiak]

​Uploading multiple files contains only a simple example how you can handle multiple files, it will validate only the first file. It's not a bug in ImageField because it doesn't support uploading multiple files.

I agree that we we could improve this example (forms.py) with adding all files validation.

[Mahanth kumar]

Replying to felixxm:

​Uploading multiple files contains only a simple example how you can handle multiple files, it will validate only the first file. It's not a bug in ImageField because it doesn't support uploading multiple files.

I agree that we we could improve this example (forms.py) with adding all files validation.

Im thinking to add a note under the example regarding the all files validation,Is that Okay?
or how should i improve the forms.py example

[Jasper Cramwinckel]

When I add a validator to the image form (using something like ​https://gist.github.com/mobula/da99e4db843b9ceb3a3f ), only the first image gets validated. I assume that is another consequence of the problem described above. This way, it is not possible to check if the uploaded images are not too big. For a developer who is using validators for multi image uploads, it is hard to detect that the code doesn't behave as expected.
Shouldn't this be reclassified as a bug?

[Mariusz Felisiak <felisiak.mariusz@…>]

In fb4c55d:

Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of validation when uploading multiple files using one form field.

Thanks Moataz Al-Sharida and nawaik for reports.

Co-authored-by: Shai Berger <shai@…>
Co-authored-by: nessita <124304+nessita@…>

[Mariusz Felisiak <felisiak.mariusz@…>]

In 21b1b1fc:

[4.2.x] Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of validation when uploading multiple files using one form field.

Thanks Moataz Al-Sharida and nawaik for reports.

Co-authored-by: Shai Berger <shai@…>
Co-authored-by: nessita <124304+nessita@…>

[Mariusz Felisiak <felisiak.mariusz@…>]

In e7c3a2c:

[4.1.x] Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of validation when uploading multiple files using one form field.

Thanks Moataz Al-Sharida and nawaik for reports.

Co-authored-by: Shai Berger <shai@…>
Co-authored-by: nessita <124304+nessita@…>

[Mariusz Felisiak <felisiak.mariusz@…>]

In eed53d0:

[3.2.x] Fixed CVE-2023-31047, Fixed #31710 -- Prevented potential bypass of validation when uploading multiple files using one form field.

Thanks Moataz Al-Sharida and nawaik for reports.

Co-authored-by: Shai Berger <shai@…>
Co-authored-by: nessita <124304+nessita@…>

[Natalia Bidart]

Related PR with docs clarifications: ​https://github.com/django/django/pull/18044
Merged in ba4ffdc8771c2f38cf6de26a2b82bbceea2b933a