From 3a9bc02796540c789d12abb53bd2656b133449af Mon Sep 17 00:00:00 2001
From: Stephen Adamson <popertots@gmail.com>
Date: Fri, 10 Jul 2026 12:06:12 +0100
Subject: [PATCH] fix: check ParseMultipartForm errors, reduce maxMemory,
 handle 413 properly

---
 backend/handlers/portfolio/images.go | 12 ++++++++++--
 backend/handlers/user/profile.go     | 11 +++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/backend/handlers/portfolio/images.go b/backend/handlers/portfolio/images.go
index 29d7810..a1e8fe7 100644
--- a/backend/handlers/portfolio/images.go
+++ b/backend/handlers/portfolio/images.go
@@ -11,6 +11,7 @@ import (
 	"crussell/mw"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -705,8 +706,15 @@ func UploadImage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	//nolint:errcheck // parse errors are non-fatal; form values may still be available
-	_ = r.ParseMultipartForm(50 << 20)
+	if err := r.ParseMultipartForm(10 << 20); err != nil {
+		var maxBytesErr *http.MaxBytesError
+		if errors.As(err, &maxBytesErr) {
+			http.Error(w, "Upload too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		// Non-size parse errors: log but continue — form values (tags) may be available
+		log.Printf("Warning: ParseMultipartForm: %v", err)
+	}
 
 	tagsStr := r.FormValue("tags")
 	tags := []string{}
diff --git a/backend/handlers/user/profile.go b/backend/handlers/user/profile.go
index 8d0e025..23715cf 100644
--- a/backend/handlers/user/profile.go
+++ b/backend/handlers/user/profile.go
@@ -1002,8 +1002,15 @@ func UploadProfilePictureHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	//nolint:errcheck // parse errors are non-fatal; form values may still be available
-	_ = r.ParseMultipartForm(10 << 20)
+	if err := r.ParseMultipartForm(1 << 20); err != nil {
+		var maxBytesErr *http.MaxBytesError
+		if errors.As(err, &maxBytesErr) {
+			http.Error(w, "Profile picture too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		// Non-size parse errors: log but continue — form values may still be available
+		log.Printf("Warning: ParseMultipartForm: %v", err)
+	}
 
 	file, _, err := r.FormFile("file")
 	if err != nil {