fix: treat empty file inputs as no upload on add-to-cart

[ssx]

Follow-up to #1, which merged before this fix was pushed. The branch commit landed on feature/surfaceguard-v1 after the merge, so this fix is not on main — main currently carries the bug described below.

The bug

[P1] With cart_add_file switched off, an ordinary purchase returns 403 whenever the product has an optional file option the customer left empty.

The controller guard counted entries in the request's file collection and read a non-empty collection as proof of an upload. It is not:

• PHP puts every file input on a submitted multipart form into $_FILES, including ones left empty, with error = UPLOAD_ERR_NO_FILE and size = 0.

• Laminas' mapPhpFiles() (laminas-http/src/PhpEnvironment/Request.php:408) copies every $_FILES entry through to the request's file parameters. Nothing filters the empty ones — I grepped the framework and module-catalog for UPLOAD_ERR_NO_FILE and there is no such filtering anywhere.

• The product view form sets enctype="multipart/form-data" whenever the product has any option, not only a file one:

  <form ... <?php if ($_product->getOptions()) :?> enctype="multipart/form-data"<?php endif; ?>>

  (module-catalog/view/frontend/templates/product/view/form.phtml:21)

So the 403 fired on a normal add-to-cart, and it fired at the controller — before the backstop's no-upload handling from #1 could run. This is the same bug class as finding 1 on that PR, surviving one layer up.

The fix

The guard now walks the mapped entries and counts one only when it carries a real upload: an entry whose error is anything other than UPLOAD_ERR_NO_FILE. A file PHP rejected for exceeding the size limit still counts, because a file was still sent and refusing it is the intended behaviour. The walk recurses, because Laminas nests entries when an input name carries brackets (mapPhpFileParam).

Audit of the other guards

Checked each one for the same assumption:

Guard	Verdict
DenyCartAddFile	The bug. Fixed here.
DenyCustomerFileUpload	Unaffected. Both the open-source Address\File\Upload and the Commerce AbstractUploadFile check empty($requestedFiles) before constructing the uploader, and neither sits on a purchase path.
DenyCartItemFileOption	Unaffected. Reads option structure, never a files collection.
DenyFileOptionBackstop	Already correct. Uses core's isUploaded(), which returns false when empty($file['name']) — exactly the empty-input case.

Verification

• 43 tests, 73 assertions, all green against the real EE 2.4.8-p5 tree (was 36/59).
• New coverage: four shapes that must not count as uploads — a single empty optional option, two empty options, a nested bracketed input, and a deeply nested one — and four that must: a flat upload, a nested upload, a mixed submission where one option is empty and another carries a file, and a file rejected by PHP for size.
• All five XML files validate against the framework XSDs; php -l clean.
• Unchanged from feat: SurfaceGuard — env.php kill switches for the unauthenticated upload entry points #1: phpcs --standard=Magento2 not run (not installed in the available vendor tree), and setup:di:compile still not run against a live install.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.