From d7b8594a58e8b8482205d54db569f1914249a7f0 Mon Sep 17 00:00:00 2001 From: Daniel Covington Date: Mon, 26 Oct 2026 10:58:46 -0400 Subject: [PATCH] Import: say why the upload form-state check failed The CSRF failure on /import/upload used one generic message. It now tells apart an empty upload, a missing token, and a session mismatch. Co-Authored-By: Claude Sonnet 5.5 --- app/controllers/ImportController.asp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/app/controllers/ImportController.asp b/app/controllers/ImportController.asp index e131ef0..5fde2b1 100644 --- a/app/controllers/ImportController.asp +++ b/app/controllers/ImportController.asp @@ -47,7 +47,13 @@ Class ImportController_Class up.Upload If Not Csrf_Valid("import", up.Form("csrf")) Then - Flash().AddError "Invalid form state. Please try again." + If up.FormElements.Count = 0 Then + Flash().AddError "Invalid form state: the upload was not received (" & Request.TotalBytes & " bytes). Please try again." + ElseIf Len(up.Form("csrf")) = 0 Then + Flash().AddError "Invalid form state: the form token was missing from the upload. Please try again." + Else + Flash().AddError "Invalid form state: your session expired or changed. Reload this page and try again." + End If Response.Redirect "/import" End If