Gokapi Version
v2.2.4
Operating System / Deployment
Docker (Official Image)
Storage Backend
Local Disk
Database
Other
Steps to Reproduce
A standard (non-admin) user gets a 400 Bad Request when trying to create a File Request for the first time, while an admin user can create one without any issue. The frontend shows Error: Request failed with status: 400 on the POST /api/uploadrequest/save call, with error code AdminOnly in the response body ("Only admin users can create requests with unlimited size / file count or values larger than the server's max size / file count").
Root cause
In internal/webserver/Webserver.go, the values used to inform the frontend of the guest-upload size/file limits are only set as a side effect of iterating over existing file requests:
case ViewFileRequests:
for _, fileRequest := range filerequest.GetAll() {
...
u.FileRequests = append(u.FileRequests, fileRequest)
if !user.IsAdmin() {
u.FileRequestMaxFiles = configuration.GetEnvironment().MaxFilesGuestUpload
u.FileRequestMaxSize = configuration.GetEnvironment().MaxSizeGuestUploadMb
}
}
If the current non-admin user has no visible file requests yet (e.g. they've never created one, or none exist that they're allowed to see), the loop body never runs, so u.FileRequestMaxFiles / u.FileRequestMaxSize stay at their zero value. These are passed to the template as limitMaxFiles / limitMaxSize (html_uploadrequest.tmpl), which the frontend (admin_ui_filerequest.js) uses to force the "Max files" / "Max size" checkboxes to a bounded value for non-admins. With both at 0, the frontend treats the user as unrestricted and lets them submit the form with "unlimited" (maxfiles=0, maxsize=0).
The backend check in internal/webserver/api/Api.go (isUserAllowedUnlimited) is correct and independent of the above bug — it always enforces MAX_FILES_GUESTUPLOAD / MAX_SIZE_GUESTUPLOAD (defaults: 100 files / 10240 MB) for non-admins on a new request. So the mismatch between what the frontend allows and what the backend enforces results in the 400 error, specifically for a non-admin user's first file request.
Steps to reproduce
As admin, create a standard user and grant them "Create file requests" (PERM_GUEST_UPLOAD).
Log in as that user (who has no existing file requests).
Go to File Requests → New File Request, leave "Max files" and "Max size" unchecked (default state), fill in a name, save.
Observe the 400 error.
As a workaround, manually check "Max files" and "Max size" and set values within the server limits — the save then succeeds. Any subsequent file request creation by this user also works, since the list is no longer empty.
Suggested fix
Move the limit assignment out of the loop so it's set unconditionally for non-admin users, regardless of how many file requests currently exist:
case ViewFileRequests:
if !user.IsAdmin() {
u.FileRequestMaxFiles = configuration.GetEnvironment().MaxFilesGuestUpload
u.FileRequestMaxSize = configuration.GetEnvironment().MaxSizeGuestUploadMb
}
for _, fileRequest := range filerequest.GetAll() {
...
}
Disclosure: This investigation (log analysis, permission/token checks, and root-cause
identification in the Go source) was carried out with the assistance of Claude (Anthropic).
I reviewed and reproduced the described behavior on my own instance before opening this issue.
Additional Context
No response
Relevant Logs
Before submitting
Gokapi Version
v2.2.4
Operating System / Deployment
Docker (Official Image)
Storage Backend
Local Disk
Database
Other
Steps to Reproduce
A standard (non-admin) user gets a 400 Bad Request when trying to create a File Request for the first time, while an admin user can create one without any issue. The frontend shows Error: Request failed with status: 400 on the POST /api/uploadrequest/save call, with error code AdminOnly in the response body ("Only admin users can create requests with unlimited size / file count or values larger than the server's max size / file count").
Root cause
In internal/webserver/Webserver.go, the values used to inform the frontend of the guest-upload size/file limits are only set as a side effect of iterating over existing file requests:
case ViewFileRequests:
for _, fileRequest := range filerequest.GetAll() {
...
u.FileRequests = append(u.FileRequests, fileRequest)
if !user.IsAdmin() {
u.FileRequestMaxFiles = configuration.GetEnvironment().MaxFilesGuestUpload
u.FileRequestMaxSize = configuration.GetEnvironment().MaxSizeGuestUploadMb
}
}
If the current non-admin user has no visible file requests yet (e.g. they've never created one, or none exist that they're allowed to see), the loop body never runs, so u.FileRequestMaxFiles / u.FileRequestMaxSize stay at their zero value. These are passed to the template as limitMaxFiles / limitMaxSize (html_uploadrequest.tmpl), which the frontend (admin_ui_filerequest.js) uses to force the "Max files" / "Max size" checkboxes to a bounded value for non-admins. With both at 0, the frontend treats the user as unrestricted and lets them submit the form with "unlimited" (maxfiles=0, maxsize=0).
The backend check in internal/webserver/api/Api.go (isUserAllowedUnlimited) is correct and independent of the above bug — it always enforces MAX_FILES_GUESTUPLOAD / MAX_SIZE_GUESTUPLOAD (defaults: 100 files / 10240 MB) for non-admins on a new request. So the mismatch between what the frontend allows and what the backend enforces results in the 400 error, specifically for a non-admin user's first file request.
Steps to reproduce
As admin, create a standard user and grant them "Create file requests" (PERM_GUEST_UPLOAD).
Log in as that user (who has no existing file requests).
Go to File Requests → New File Request, leave "Max files" and "Max size" unchecked (default state), fill in a name, save.
Observe the 400 error.
As a workaround, manually check "Max files" and "Max size" and set values within the server limits — the save then succeeds. Any subsequent file request creation by this user also works, since the list is no longer empty.
Suggested fix
Move the limit assignment out of the loop so it's set unconditionally for non-admin users, regardless of how many file requests currently exist:
case ViewFileRequests:
if !user.IsAdmin() {
u.FileRequestMaxFiles = configuration.GetEnvironment().MaxFilesGuestUpload
u.FileRequestMaxSize = configuration.GetEnvironment().MaxSizeGuestUploadMb
}
for _, fileRequest := range filerequest.GetAll() {
...
}
Disclosure: This investigation (log analysis, permission/token checks, and root-cause
identification in the Go source) was carried out with the assistance of Claude (Anthropic).
I reviewed and reproduced the described behavior on my own instance before opening this issue.
Additional Context
No response
Relevant Logs
Before submitting