fix: cap Base64 media transfers at 10 MB, upload limit at most 32 MB

tests/Unit/Admin/LimitsTabTest.php

@@ -40,7 +40,9 @@ final class LimitsTabTest extends TestCase
         self::assertSame(3, substr_count($html, 'type="number"'));
         self::assertStringContainsString('name="lit_mcp_limits[upload_mb]" value="8"', $html);
         self::assertStringContainsString('name="lit_mcp_limits[log_retention_days]" value="90"', $html);
-        self::assertStringContainsString('min="1" max="100"', $html);
+        self::assertStringContainsString('min="1" max="32"', $html);
+        self::assertStringContainsString('höchstens 32', $html);
+        self::assertStringContainsString('10 MB', $html);
         self::assertStringContainsString('min="1" max="3650"', $html);
     }
 
@@ -50,7 +52,7 @@ final class LimitsTabTest extends TestCase
         Functions\stubTranslationFunctions();
         Functions\when('settings_fields')->justReturn(null);
         Functions\when('submit_button')->justReturn(null);
-        Functions\when('get_option')->justReturn(['upload_mb' => 50]);
+        Functions\when('get_option')->justReturn(['upload_mb' => 20]);
         Functions\when('wp_max_upload_size')->justReturn(2 * 1024 * 1024);
 
         ob_start();
@@ -58,7 +60,7 @@ final class LimitsTabTest extends TestCase
         $html = (string) ob_get_clean();
 
         self::assertStringContainsString('class="description"', $html);
-        self::assertMatchesRegularExpression('/50 MB.*2 MB/s', $html);
+        self::assertMatchesRegularExpression('/20 MB.*2 MB/s', $html);
     }
 
     public function testNoWarningWhenUploadMbIsWithinTheServersOwnUploadLimit(): void

tests/Unit/Integrations/Media/MediaDownloadAbilityTest.php

@@ -62,6 +62,18 @@ final class MediaDownloadAbilityTest extends TestCase
         self::assertSame('lit_unsupported', $result->get_error_code());
     }
 
+    public function testDownloadsAreCappedAtTenMegabytesEvenWithAHigherUploadLimit(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 32]);
+        file_put_contents($this->file, str_repeat('x', 10 * 1024 * 1024 + 1));
+
+        $result = (new MediaDownloadAbility(new Limits()))->execute(['id' => 40]);
+
+        self::assertSame('lit_unsupported', $result->get_error_code());
+        self::assertStringContainsString('Limit 10 MB', $result->get_error_message());
+        self::assertStringContainsString('URL', (string) $result->get_error_data()['hint']);
+    }
+
     public function testUnknownSizeIsNotFound(): void
     {
         Functions\when('get_option')->justReturn([]);

tests/Unit/Integrations/Media/MediaImporterTest.php

@@ -131,6 +131,18 @@ final class MediaImporterTest extends TestCase
         self::assertSame([], $this->tempFiles, 'no temp file may be written for an oversized upload');
     }
 
+    public function testBase64UploadsAreCappedAtTenMegabytesEvenWithAHigherUploadLimit(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 32]);
+
+        $result = $this->importer()->fromBase64(str_repeat('A', 16 * 1024 * 1024), 'big.png', []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('Limit 10 MB', $result->get_error_message());
+        self::assertStringContainsString('lit/media-upload-from-url', (string) $result->get_error_data()['hint']);
+        self::assertSame([], $this->tempFiles);
+    }
+
     public function testInvalidBase64IsRejected(): void
     {
         $result = $this->importer()->fromBase64('***', 'x.png', []);

tests/Unit/Integrations/Media/MediaUploadAbilitiesTest.php

@@ -154,4 +154,12 @@ final class MediaUploadAbilitiesTest extends TestCase
         self::assertFalse($ability->isDirect());
         self::assertTrue((new MediaUploadFromUrlAbility(Mockery::mock(MediaImporter::class), $this->uploads()))->isDirect());
     }
+
+    public function testDescriptionNamesTheTenMegabyteCapForBase64(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 32]);
+        $ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
+
+        self::assertStringContainsString('höchstens 10 MB', $ability->description());
+    }
 }

tests/Unit/LimitsTest.php

@@ -24,7 +24,7 @@ final class LimitsTest extends TestCase
     {
         Functions\when('get_option')->justReturn(['upload_mb' => 500, 'log_retention_days' => 0, 'snapshot_count' => '7']);
 
-        self::assertSame(['upload_mb' => 100, 'log_retention_days' => 1, 'snapshot_count' => 7], (new Limits())->all());
+        self::assertSame(['upload_mb' => 32, 'log_retention_days' => 1, 'snapshot_count' => 7], (new Limits())->all());
     }
 
     public function testCorruptOptionFallsBackToDefaults(): void
@@ -45,7 +45,7 @@ final class LimitsTest extends TestCase
 
     public function testBoundsMatchesWhatSanitizeClampsTo(): void
     {
-        self::assertSame([1, 100], Limits::bounds()['upload_mb']);
+        self::assertSame([1, 32], Limits::bounds()['upload_mb']);
         self::assertSame([1, 3650], Limits::bounds()['log_retention_days']);
         self::assertSame([1, 100], Limits::bounds()['snapshot_count']);
 
@@ -61,4 +61,23 @@ final class LimitsTest extends TestCase
             Limits::sanitize($tooHigh)
         );
     }
+
+    public function testInlineTransfersAreCappedAtTenMegabytes(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 32]);
+        $limits = new Limits();
+
+        self::assertSame(32 * 1024 * 1024, $limits->uploadBytes());
+        self::assertSame(10 * 1024 * 1024, $limits->inlineBytes());
+        self::assertSame(10, $limits->inlineMegabytes());
+    }
+
+    public function testInlineLimitFollowsALowerUploadLimit(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 3]);
+        $limits = new Limits();
+
+        self::assertSame(3 * 1024 * 1024, $limits->inlineBytes());
+        self::assertSame(3, $limits->inlineMegabytes());
+    }
 }