Show a message when a builder save exceeds post_max_size by vivi-the-going-merry[bot] · Pull Request #3625 · Strategy11/formidable-forms

vivi-the-going-merry · 2026-10-27T12:13:09Z

Fixes the Lite half of Strategy11/formidable-pro#6921.

What was broken

When the builder's Update request is larger than PHP's post_max_size, PHP drops the whole body. $_POST arrives empty, route() takes the edit action from the URL and redraws the builder from the database. Every change is lost and nothing tells the user. With "Load and save form builder page with AJAX" on, admin-ajax.php answers 400 0 and the JS quietly resubmits the same oversized form, which fails the same way.

What changed

FrmFormsController::route(): an empty POST on the edit/update action that is larger than post_max_size now redraws the builder with a message that names the limit and links to the server-limits docs. update() is skipped on purpose; it would also add a misleading permission/nonce error because the nonce was dropped too.
submitBuild() error handler (js/src/admin/admin.js and the compiled js/formidable_admin.js, hand-patched because the bundle isn't byte-reproducible): a 413, or a 400 with body 0, no longer resubmits. It clears the saving state, keeps the edits on screen and shows a modal (frm_admin_js.save_too_large). Other failures still fall back to the normal submit.
PHPUnit: test_post_exceeds_max_size covers oversized-empty, at-limit, parsed-POST and GET cases.

How verified

php -l on the changed PHP files, node --check on the patched bundle.
The patched minified handler was run in a node harness with fake e/Re/a/qi: 413 and 400+0 show the modal, 400+other and 500 still resubmit.
CI: see checks on this PR.
Not done: a live before/after screenshot. The preview env (Playground/PHP-wasm) can't set post_max_size, so the oversized request can't be reproduced there.

Not in this PR

formidable-pro#6922 (max_input_vars on the front end) is a separate fix.

Closes Strategy11/formidable-pro#6921

🤖 Generated with Claude Code

PHP drops the whole body of an oversized POST, so the builder redrew from the database with no message. Detect the empty POST and redraw with an error instead. Refs Strategy11/formidable-pro#6921 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

A 400 with body 0 or a 413 means the request never reached the handler, so resubmitting the form the normal way loses the edits too. Refs Strategy11/formidable-pro#6921 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-27T12:13:18Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Strategy11/formidable-forms
Branch: master
File: .coderabbit.yaml
Commit: c5b435b
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: e2c07257-13ca-4c52-a20c-cd5e7225dc2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-10-27T12:16:02Z

DeepSource Code Review

We reviewed changes in c5b435b...3a7a12b on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Oct 27, 2026 12:13p.m.	Review ↗
JavaScript		Oct 27, 2026 12:13p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-10-27T12:16:10Z

DeepSource Code Review

We reviewed changes in c5b435b...3a7a12b on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Oct 27, 2026 12:13p.m.	Review ↗
JavaScript		Oct 27, 2026 12:13p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-10-27T12:16:24Z

@@ -39,6 +39,37 @@ public function test_get_form_shortcode() {
 		$this->assertNotEmpty( strpos( $form, '<form ' ), 'The form is missing' );


Call to an undefined method test_FrmFormsController::assertNotEmpty()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-27T12:16:24Z

+		$limit = wp_convert_hr_to_bytes( (string) ini_get( 'post_max_size' ) );
+
+		if ( $limit <= 0 ) {
+			$this->markTestSkipped( 'post_max_size is unlimited' );


Call to an undefined method test_FrmFormsController::markTestSkipped()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-27T12:16:24Z

+		$_POST                     = array();
+
+		$_SERVER['CONTENT_LENGTH'] = $limit + 1;
+		$this->assertTrue( FrmFormsController::post_exceeds_max_size(), 'An empty POST larger than the limit should be flagged' );


Call to an undefined method test_FrmFormsController::assertTrue()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-27T12:16:24Z

+		$this->assertTrue( FrmFormsController::post_exceeds_max_size(), 'An empty POST larger than the limit should be flagged' );
+
+		$_SERVER['CONTENT_LENGTH'] = $limit;
+		$this->assertFalse( FrmFormsController::post_exceeds_max_size(), 'A POST within the limit should not be flagged' );


Call to an undefined method test_FrmFormsController::assertFalse()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-27T12:16:24Z

+
+		$_SERVER['CONTENT_LENGTH'] = $limit + 1;
+		$_POST                     = array( 'id' => 1 );
+		$this->assertFalse( FrmFormsController::post_exceeds_max_size(), 'A POST that PHP parsed should not be flagged' );


Call to an undefined method test_FrmFormsController::assertFalse()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-27T12:16:24Z

+
+		$_POST                     = array();
+		$_SERVER['REQUEST_METHOD'] = 'GET';
+		$this->assertFalse( FrmFormsController::post_exceeds_max_size(), 'A GET request should not be flagged' );


Call to an undefined method test_FrmFormsController::assertFalse()

The method you are trying to call is not defined, which can result in a fatal error.

codecov · 2026-10-27T12:20:01Z

Codecov Report

❌ Patch coverage is 33.33333% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.38%. Comparing base (c95bdaa) to head (3a7a12b).
⚠️ Report is 113 commits behind head on master.

Files with missing lines	Patch %	Lines
classes/controllers/FrmFormsController.php	35.29%	11 Missing ⚠️
classes/helpers/FrmAppHelper.php	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3625      +/-   ##
============================================
+ Coverage     42.74%   43.38%   +0.63%     
- Complexity    13720    13889     +169     
============================================
  Files           233      235       +2     
  Lines         46525    47018     +493     
============================================
+ Hits          19886    20397     +511     
+ Misses        26639    26621      -18

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

vivi-the-going-merry · 2026-10-27T12:22:05Z

Not labeled franky-review yet: this changes rendered output (a new builder error message and modal) and I couldn't capture the before/after image the PR template requires. The preview env runs PHP in WASM and can't set post_max_size, so the oversized request can't be reproduced there. Checks: PHPUnit green on all four PHP versions; ESLint, Stylelint, PHPCS, PHPStan, Mago, Rector and PHP CS Fixer pass. Psalm fails on master already (MissingPureAnnotation across the repo, nothing on these lines). DeepSource JS/PHP report blocking issues I can't read without a login. Needs someone with a real PHP-FPM site and post_max_size = 64K to confirm the message and add the screenshot, then add franky-review.

vivi-the-going-merry Bot and others added 2 commits October 27, 2026 06:12

vivi-the-going-merry Bot added the run analysis label Oct 27, 2026

vivi-the-going-merry Bot added the run tests label Oct 27, 2026

deepsource-io Bot reviewed Oct 27, 2026

View reviewed changes

Navigation Menu

Repository navigation

Show a message when a builder save exceeds post_max_size - #3625

Show a message when a builder save exceeds post_max_size#3625
vivi-the-going-merry[bot] wants to merge 2 commits into
masterfrom
fix/issue-6921-post-max-size-builder

vivi-the-going-merry Bot commented Oct 27, 2026

Uh oh!

coderabbitai Bot commented Oct 27, 2026

Review skipped

Uh oh!

deepsource-io Bot commented Oct 27, 2026

Uh oh!

deepsource-io Bot commented Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

deepsource-io Bot Oct 27, 2026

Uh oh!

codecov Bot commented Oct 27, 2026

Uh oh!

vivi-the-going-merry Bot commented Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

		@@ -39,6 +39,37 @@ public function test_get_form_shortcode() {
		$this->assertNotEmpty( strpos( $form, '<form ' ), 'The form is missing' );

Conversation

vivi-the-going-merry Bot commented Oct 27, 2026

What was broken

What changed

How verified

Not in this PR

Uh oh!

coderabbitai Bot commented Oct 27, 2026

Review skipped

Uh oh!

deepsource-io Bot commented Oct 27, 2026

DeepSource Code Review

Code Review Summary

Uh oh!

deepsource-io Bot commented Oct 27, 2026

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::assertNotEmpty()

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::markTestSkipped()

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::assertTrue()

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::assertFalse()

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::assertFalse()

Uh oh!

deepsource-io Bot Oct 27, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmFormsController::assertFalse()

Uh oh!

codecov Bot commented Oct 27, 2026

Codecov Report

Uh oh!

vivi-the-going-merry Bot commented Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants