Limit the images that previews keep.

A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.

publish/post.lib.php

@@ -121,7 +121,7 @@ function save_data($id = NULL) {
 
   // Prune filesystem
   if ($image_file)
-    prune_images($image_file);
+    prune_images();
 
   // email admin if added to the queue
   if ($action == 'submit')
@@ -156,9 +156,9 @@ function get_mimetype($image_file) {
 }
 
 function save_uploaded_file() {
-  // A new upload in this request
+  // A new upload in this request: PHP removes the file after the request
   if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
-    return store_upload($_FILES['upload']['tmp_name']);
+    return $_FILES['upload']['tmp_name'];
   }
   // An image uploaded at the preview step; the session knows which one
   if (($_POST['uploaded'] ?? '') === 'pending') {
@@ -167,22 +167,10 @@ function save_uploaded_file() {
   return FALSE;
 }
 
-function prune_images($image_file) {
-  // Delete the saved image, and anything older than $age.
-  // Only ever touch upload files inside the upload directory.
-  $age = 86400; // a day old
-  $dir = upload_dir();
-  if (dirname($image_file) === $dir && is_upload_name(basename($image_file))) {
-    @unlink($image_file);
-  }
-  unset($_SESSION['pending_upload']);
-
-  foreach (glob($dir . '/*') as $cleanup_file) {
-    if (is_upload_name(basename($cleanup_file)) &&
-        @filemtime($cleanup_file) < (time() - $age)) {
-      @unlink($cleanup_file);
-    }
-  }
+// After a save: remove this session's upload, and any abandoned uploads
+function prune_images() {
+  remove_pending_upload();
+  prune_uploads();
 }
 
 /*

publish/preview.inc.php

@@ -5,10 +5,14 @@ extract($result[0], EXTR_OVERWRITE);
 echo '<p>Please review your submission. Once you\'ve finished, please click "Submit" at the bottom of the page, or click "Preview" to check it again.</p>';
 
 // Keep a new image outside the web root until the story is saved;
-// display.php shows it to this session only.
-if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') && !isset($validate['upload'])) {
+// display.php shows it to this session only. A request that failed the
+// captcha or the form token keeps nothing.
+if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') &&
+    !isset($validate['upload']) && !isset($validate['captcha']) && !isset($validate['csrf'])) {
   if (store_upload($_FILES['upload']['tmp_name']))
     $file_src = pending_upload_url();
+  else
+    $validate['upload'] = 'The site cannot keep more images just now. Please try again later.';
 } else if (isset($uploaded) && $uploaded === 'pending' && pending_upload() && !$remove_img) {
   $file_src = pending_upload_url();
 }