Galette

I confirm I can reproduce using drag& drop on your "crop branch" (d&d on demo does not work).

It strange because error on exceeded size is displayed with 3.9Mio file; and I get the CSRF error with a 7.4Mio one... I'll take a look.

I absolutely do not understand what is happening here... Event this is a PHP or a Slim framework behavior; but with very large images, nothing is sent back with ajax request when it's sent to CSRF check middleware: request body is entirely empty.

I was about to send a message on Slim support; but it's quite hard to explain, and they'll ask for a reproducible case. Also, I'm not 100% sure this is a Slim, a CSRF guard or a Galette issue...

The UI display a message indicating image upload has failed; it's probably enough most of the time, and wa also can adapt the message with something like "maybe your image is too heavy".

Anyway, I've changed priority, we can see that later.

In facts, a warning is displayed in PHP system logs, because the post_max_size limit has been reached. I've not been able to catch it Galette side:

PHP Warning:  PHP Request Startup: POST Content-Length of 10349468 bytes exceeds the limit of 8388608 bytes in Unknown on line 0

It seems like the same issue appears when the max_input_vars limit is reached; we only see a CSRF issue; because in those case the POST request is empty (and therefore does not contains the valid CSRF).
It also seems this appears on ajax requests; not on regular ones (I'm not sure for max_input_vars but I am for post_max_size

I just took another look at this, and the problem is it's not possible to handle the drag and drop error sent that way. A PHP error is thrown in pre-script; there is no way to handle it correctly.

I've tried to disable CSRF check when the case occurs (when POST is entirely empty), it ends with a "required missing argument" from the ajax photo route. While it's maybe better than a CSRF check issue, that's still not understandable.

The real issue is only shown in PHP system logs; which are not available for every Galette users. Solution would be to chek file size from JS, but It seems another time a lot of job for almost nothing.
I do not know if there is an alternative JS solution that would rely on the "standard" PHP upload that works well - or if we should just remove the image drag and drop (this is not the feature of the year, I consider I've already lost a lot of time on this).