PPOM file upload shows refresh-page nonce error when selecting multiple files

[pirate-bot]

Summary

A PPOM file upload field configured to allow multiple files accepts a single file, but selecting two or more files can immediately show the upload error asking the user to refresh the page.

Expected behavior: files within the configured count, size, and extension limits upload successfully when selected together.

Actual behavior: the upload flow returns the refresh-page error before the files are accepted.

Impact: stores using PPOM file fields for multiple customer uploads may be unable to collect more than one file through the field.

Customer context

• Product / area: PPOM Pro file upload field, backed by PPOM core upload handling
• Version: Customer did not provide plugin versions. Inspected workspace versions: PPOM core 34.0.4, PPOM Pro 27.0.2.
• Environment: PHP 8.3.31; upload_max_filesize 128 MB; post_max_size 128 MB; memory_limit 512 MB; max_file_uploads 20.
• Integration / third party: WooCommerce product option upload flow; no specific third-party integration identified.
• Reported error / symptom: “The file cannot be uploaded at this time. Please refresh the page and try again. Note that your current selection options will be reset.” translated in German.
• Impact: One file uploads, but selecting two or more files fails for the reported field configuration.

Reproduction notes

Reported reproduction:

1. Create a PPOM file upload field configured for multiple uploads.
2. Use settings equivalent to Allowed files: 10, Max file size: 30 MB, and allowed extensions jpg,jpeg,png,pdf.
3. On the product page, select one small image file: upload succeeds.
4. Select two or more files: the upload immediately shows the refresh-page error.

Local runtime reproduction was not performed in this triage. The source path and exact error mapping were inspected in PPOM core and PPOM Pro; Pro does not appear to override this upload flow in the checked code.

Diagnosis

Conclusion

The report is a confirmed PPOM core upload defect for the inspected path. The exact reported error is emitted by the upload AJAX handler only when the upload nonce verification branch is reached, and the frontend multi-file path starts uploads from a per-file loop while nonce refresh is performed in an async Plupload callback. The async callback behavior was not runtime-verified against Plupload in this triage, but the combination of the exact product error, reported reproducibility, and source flow is strong enough to open a product bug.

Where this likely occurs

• User-visible surface: PPOM file upload field on the WooCommerce product page when a field allows multiple files and the customer selects more than one file in one selection.
• src/Files/PublicUploadAjaxHooks.php — PublicUploadAjaxHooks::register() lines 18–20 registers guest and logged-in ppom_upload_file AJAX requests.
• inc/files.php — ppom_upload_file() lines 74–75 forwards the AJAX action to PPOM\Files\Handler::upload_file().
• src/Files/Handler.php — Handler::upload_file() lines 217–223 sanitizes $_REQUEST['ppom_nonce'], verifies it against ppom_uploading_file_action, and returns the exact refresh-page error when verification fails.
• templates/render-fields.php — file field rendering lines 635–677 passes files_allowed, file_types, file_size, and related upload metadata into the frontend field settings.
• js/file-upload.js — ppom_setup_file_upload_input() lines 545–566 initializes Plupload with multipart_params.ppom_nonce from ppom_file_vars.ppom_file_upload_nonce and max_file_count from file_input.files_allowed.
• js/file-upload.js — ppom_setup_file_upload_input() lines 613–739 handles FilesAdded; for each accepted file it increments field_file_count, adds the preview placeholder, and calls up.start() inside the loop.
• js/file-upload.js — ppom_setup_file_upload_input() lines 915–933 declares BeforeUpload as async, awaits ppom_refresh_file_nonces(), then updates multipart_params with the current upload nonce. This is the likely failing contract if Plupload does not wait for returned promises before sending the request.
• js/file-upload.js — ppom_refresh_file_nonces() lines 42–100 manages a shared REST nonce-refresh promise and a five-minute cache window.
• src/Rest/Routes.php — Routes::init_nonce_api() and Routes::get_file_nonces() lines 194–223 expose /ppom/v1/nonces/file/ and return upload/delete nonces.
• classes/frontend-scripts.class.php — PPOM_Frontend_Scripts::set_localize_data() lines 600–615 localizes ppom_file_upload_nonce, ppom_file_delete_nonce, and rest_url for ppom-file-upload.
• ppom-pro/inc/Core.php — Core::hook_input_scripts() lines 610–613 only enqueues a Plupload language script for file and cropper; no Pro override of the upload AJAX handler or nonce parameters was found during inspection.
• Git history: commit 79761f13b78de047cd7c2480625703c4cc1596b5 (fix: intermittent file upload failures for users (#575)) introduced ppom_refresh_file_nonces(), the async BeforeUpload nonce refresh, REST nonce endpoint, and nonce-only tests. The commit is contained in tags v34.0.0 through v34.0.4, making this a plausible regression surface for current core versions.

Engineering notes

The server-side upload handler treats this error as a nonce verification failure rather than an upload-size, extension, MIME, or PHP limit failure. The reported field configuration is within the stated server limits, and the same field accepts one file.

The inspected PPOM Pro repository appears to rely on the core/free upload implementation for this field type. Pro-specific code checked for this area only adds Plupload localization, so the issue belongs to Codeinwp/woocommerce-product-addon based on inspected evidence.

The likely workflow is: the field metadata allows up to 10 files, Plupload queues multiple files, FilesAdded starts uploads during the same loop, and BeforeUpload attempts a promise-based nonce refresh before updating multipart_params. If Plupload continues the upload without waiting for the async callback, one or more requests can be sent with stale or not-yet-updated nonce parameters. This inference is source-based; Plupload callback promise handling was not verified from bundled library source in this triage.

Test coverage status

Relevant tests were found, but they do not cover the reported multi-file upload path.

• tests/e2e/specs/file-upload.spec.js lines 13–234 checks nonce refresh availability and the nonce endpoint, but the explicit file fields use files_allowed: '1', and the tests do not perform an actual multi-file upload.
• tests/unit/test-rest-and-admin.php lines 498–571 checks the nonce endpoint response and nonce validity, but not Plupload request timing or multi-file AJAX uploads.
• ppom-pro/tests/e2e/specs/render-smoke.spec.js was reported by the delegated sweep as only checking file uploader chrome rendering; no Pro multi-file upload regression coverage was found during inspection.

What to verify or explore next

• May be worth reproducing in the PPOM E2E environment with a file field using files_allowed: '2' or higher and selecting two small allowed files in one chooser interaction.
• May be worth capturing the AJAX request payloads for the first and second queued file to confirm whether ppom_nonce is missing, stale, or set after the request starts.
• If reproducible, checking behavior before and after commit 79761f13b78de047cd7c2480625703c4cc1596b5 would clarify the regression boundary.
• May be worth verifying the same flow for guest and logged-in users, cached and uncached product pages, and image plus PDF combinations.

Unknowns / follow-up

• The customer’s exact PPOM core and PPOM Pro plugin versions were not provided.
• Runtime behavior of Plupload promise handling was not verified from a bundled source reference during this triage.
• Browser, WooCommerce version, theme, and whether product pages are served from full-page cache remain unknown from the available evidence.

Confidence

Confidence: 82/100

The customer reports a repeatable multi-file failure with a product-generated error, and repository inspection maps that exact error to the PPOM upload nonce path with a recent async nonce-refresh change that is not covered by multi-file upload tests.

---

Source: HelpScout #3368403593
Generated by bug-report-triage (ID: bug-report-triage_6a3ea2170fbe65.64418100)

[poonam279]

@vytisbulkevicius, I am able to replicate this issue. Can we prioritize it?

[girishpanchal30]

@poonam279 I have fixed it with this PR #656