[pmwiki-users] Token invalid or missing on upload

[Petko Yotov]

You need to check in ?action=phpinfo these constants in the "Local 
value" column:

   post_max_size
   upload_max_filesize

The former needs to be larger than the latter, and in config.php 
$UploadMaxSize only matters if it is less than upload_max_filesize in 
php.ini.

The total post size is the uploaded file but also other data like the 
pmtoken, the current page name, the action=postupload, the new name of 
the file, possibly the author name.

The total post size needs to be less than post_max_size, otherwise it is 
fully rejected/deleted before even this comes to PmWiki. PmWiki first 
checks for the token, and as it is has been deleted, it returns the 
error.

There is also a Warning: "PHP Request Startup: POST Content-Length of 
XXX bytes exceeds the limit of YYY bytes in Unknown on line 0", but you 
may not notice it as the token error redirects back to the upload form.

I should think about how to catch these cases and show a more 
appropriate diagnostic but there are different upload forms, AJAX 
recipes, and other, this should be done carefully.

Petko


On 12/05/2025 23:09, Neil Herber (nospam) wrote:
> Using the vanilla PmWiki upload form I can successfully upload files
> that are well below the size limit I have set, namely 50MB
> 
> But when I try to upload a file that is 48,971,776 bytes it fails with
> the error message "Token invalid or missing".
> 
> Using version 2.4.4  with PHP 7.4 and  Apache 2.4.63 on shared hosting.
> 
> ??? Beats me!
> 
> Neil