Profile picture is missing server side validation on the size

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.1.X, 7.2.X, 7.3.X, Master
• Fix Version/s: 7.1.10 DXP FP26, 7.1.10.7 SP7, 7.1.X, 7.2.10 DXP FP15, 7.2.X, 7.3.10.3 DXP SP3, 7.3.X, 7.4.13 DXP GA1, 7.4.3.4 CE GA4, Master
• Component/s: Application Security, Documents & Media, User Management
• Labels:
  • ee-ts
  • liferay-dxp-71-sp7
  • liferay-dxp-73-sp3
  • liferay-fix-pack-dxp-3-7310
  • liferay-fixpack-dxp-15-7210
  • liferay-fixpack-dxp-26-7110
  • liferay-fixpack-dxp-3-7310
• Branch Version/s:
  7.3.x, 7.2.x, 7.1.x
• Backported to Branch:
  Committed
• Story Points: 3
• Fix Priority: 3
• Git Pull Request: https://github.com/liferay-usm/liferay-portal/pull/207
• QA Test Name:
  • dont-test-again

As a preparation, please have Burp Suite installed as it will be required to reproduce this issue.

The Community Edition is free and can be downloaded from here:
https://portswigger.net/burp/communitydownload

Steps to reproduce:

1. Start up Liferay
2. Open Burp Suite (Select Temporary project)
3. Click on Proxy from the top navbar
4. Click on Open Browser (And click on Intercept is On to turn it off)
5. Log in as the administrator
6. Go to Account settings
7. Upload the attached image (notice how the image is 390Kb and the max file size is 300Kb)
8. Go to Burp Suite and click on the Intercept is off button
9. Click on Save
10. Go back to Burp and find the following variable: _com_liferay_image_uploader_web_portlet_ImageUploaderPortlet_maxFileSize
11. Set the size of it to 100307200
12. Click on Forward in Burp
13. Turn interception off
14. Click save

Expected behavior : The image is not accepted and uploaded as it is over the size limit
Actual behavior : The image is uploaded and used