Reject invalid uploads and expand flow tests.

tests/php/Pages/SubmitTest.php

@@ -181,6 +181,24 @@ class SubmitTest extends PageTestCase {
     $this->assertNotSame($first, $second);
   }
 
+  #[DataProvider('uploadActions')]
+  public function testANestedUploadIsRejectedWithoutSaving(string $action): void {
+    $token = $this->csrfToken($this->get('/publish')['body']);
+    $before = $this->tables();
+    $page = $this->postFiles('/publish', $this->story(array('action' => $action, 'csrf_token' => $token,
+                                                          'g-recaptcha-response' => 'pass')),
+                             array('upload[]' => array('a.png', TestCase::png())));
+    $this->assertSame(200, $page['status']);
+    $this->assertStringContainsString('The upload is invalid. Please choose the image again.', $page['body']);
+    $this->assertSame($before, $this->tables());
+    $this->assertSame(array(), $this->uploads());
+    $this->assertArrayNotHasKey('pending_upload', $this->session());
+  }
+
+  public static function uploadActions(): array {
+    return array('preview' => array('preview'), 'submit' => array('submit'));
+  }
+
   public function testAFailedCaptchaKeepsNoImage(): void {
     $page = $this->previewImage(array('g-recaptcha-response' => 'fail'));
     $this->assertStringContainsString('Please complete the captcha.', $page['body']);