Set upper limit to attachment size

[manuerwin]

The app seems to allow any size file to be uploaded, strongly suggest something like a setting that optionally limits the max attachment size and displays an error/warning if exceeded to:
a) conserve storage and
b) prevent bad actors

See screenshot of the 35MB sample image I was able to upload just now (I've since deleted the expense, however I'm unsure if the image has been deleted from S3?)

[scastiel]

Agree! I found a nice way to add a limit for the file size when using next-s3-upload (the third package I used), but it requires a change in the library (see this open PR). I hope the repository is still maintained (last commit is from October), otherwise I’ll just fork the package.

[manuerwin]

Seems like that will work, for S3 which is great.
However if the size check happened in app/window, then it would be applicable to any file provider right?

[scastiel]

You’re right, I just pushed a check for the file size on the client side, which is nice for user experience anyway. But ultimately, we need to perform a better check, as for now nothing prevents a user from tweaking the code in the browser to disable the check.

[manuerwin]

Just tested latest and looks great! Agree that “server” check is needed 👍

[manuerwin]

After a bit more thought, suggest perhaps a max limit of 2MB?
That should allow for fairly large images and certainly PDF’s etc IMO.
The math on 5MB X many expenses => large over the long term IMO

[shynst]

After a bit more thought, suggest perhaps a max limit of 2MB? That should allow for fairly large images and certainly PDF’s etc IMO. The math on 5MB X many expenses => large over the long term IMO

A setting you should probably be able to tweak in a .env file, instead of having to hardcode.

[manuerwin]

Great point about the .env file, agree!