Catalyst received a bug report from a customer who is using recent Mahara (15.10.1).
The initial bug report is that if "Require agreement" is enabled in admin/extensions/pluginconfig.php?plugintype=artefact&pluginname=file&type=file and a user attempts to upload a file without first ticking the agreement box, they get a message saying the box needs to be ticked but the preview of the file also has a green tick (implying it was actually uploaded).
In my investigation of the issue, I found multiple issues:
1) Dropzone's internal handling puts the green tick there on the basis of the server status. Setting the http response code to 403 (Forbidden) fixed that.
2) Dropzone's internal handling assumes that any text returned when an error occurs is an HTML (not JSON) description of the error, and therefore puts the raw HTML in 'tooltip' for the red X. The raw HTML also ends up being displayed in the files_filebrowser_upload_messages div because the JSON.parse doesn't get called in the error handler function.
I have prepared a patch that addresses both these issues, but I don't think it's the entire solution. I'd also suggest that beginning the upload should be rejected if the box hasn't been ticked. This would avoid the scenario wherein a user attempts to upload a large file on a slow connection, only to be told after the file has been sent that it's not been saved only because they didn't tick the box.
Attaching a patch for this issue.