Can't upload cover art

[jwillikers]

Problem

When I choose a cover from my desktop to upload and hit Upload, the dialog just shows a blank rectangle instead of the uploaded picture and the picture is not uploaded. This started happening on Wednesday last week, I think.

OL62350777M
cover

Reproducing the bug

1. Download this cover and save it as Real, Vol. 1.jpg.
2. Go to edition OL62350777M.
3. Hit Edit
4. Click Add Cover Image.
5. Hit Browse.
6. Select the cover.
7. Hit upload.

• Expected behavior:
  The cover should be uploaded and then displayed in the dialog.

• Actual behavior:
  A blank rectangle is displayed and the cover is not uploaded.

Context

• Browser (Chrome, Safari, Firefox, etc): Firefox
• OS (Windows, Mac, etc): Linux
• Logged in (Y/N): Y
• Environment (prod, dev, local): prod

Breakdown

Implementation Details (for maintainers)

Requirements Checklist

• [ ]

Related files

Stakeholders

---

Instructions for Contributors

• Please run these commands to ensure your repository is up to date before creating a new branch to work on this issue and each time after pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

[Akulbanxal]

I'd like to take a look at this issue , kindly assign

[comaeclipse]

I investigated this and found the root cause (I think). Cover uploads bigger than 1 MB are getting blocked by the ModSecurity WAF with an HTTP 460 before they ever reach the app. The upload dialog's iframe just gets that empty 460 back, which is why you see a blank rectangle and the cover never saves.

I reproduced it on production: small images upload fine, but anything over ~1 MB fails instantly with a 460. It's purely about file size, not image dimensions. An 81-megapixel image that happened to compress under 1 MB uploaded fine, while a 1.1 MB image failed. That 1 MB cutoff is the giveaway: it matches ModSecurity's SecRequestBodyNoFilesLimit, whose default is exactly 1 MB. Since most real covers are 1–5 MB, almost every upload trips it.

A few things this rules out:

• It's not client_max_body_size — that's set to 50m in docker/nginx.conf.
• It's not the app's validator in openlibrary/plugins/upstream/covers.py as that allows up to 10 MB, and the request never gets that far.

ModSecurity is turned on at the server level in docker/web_nginx.conf, and the upload endpoints fall under location / so the WAF applies to them. The actual rule lives in /olsystem/etc/nginx/modsecurity_openlibrary.conf in the private olsystem repo, which is why this started without any matching change in this repo.

Suggestion: Raise (or drop) SecRequestBodyNoFilesLimit in the olsystem ModSecurity config. File uploads shouldn't be counted against a no-files body limit in the first place.