Tested with Piwigo 14.1 and 14.2
When a photo already present on the server is re-uploaded, the server crashes with the following trace log:

```
2024/02/03 16:31:46 [error] 302#302: *399 FastCGI sent in stderr: "PHP message: PHP Fatal error: 
Uncaught mysqli_sql_exception: Duplicate entry '66-2' for key 'PRIMARY' in
include/dblayer/functions_mysqli.inc.php:132

Stack trace:
#0 include/dblayer/functions_mysqli.inc.php(132): mysqli->query()
#1 include/dblayer/functions_mysqli.inc.php(550): pwg_query()
#2 admin/include/functions.php(1914): mass_inserts()
#3 admin/include/functions_upload.inc.php(444): fill_lounge()
#4 admin/include/functions_upload.inc.php(179): add_uploaded_file_add_to_categories()
#5 include/ws_functions/pwg.images.php(1852): add_uploaded_file()
#6 include/ws_core.inc.php(600): ws_images_uploadAsync()
#7 include/ws_protocols/rest_handler.php(41): PwgServer->invoke()
#8 include/ws_core.inc.php(281): PwgRestRequestHandler->handleRequest()
#9 ws.php(22): PwgServer->run()
#10 {main}
  thrown in include/dbl" while reading response header from upstream, client: ###:###:###:###,
server: _, request: "POST /ws.php?format=json&method=pwg.images.uploadAsync HTTP/1.1",
upstream: "fastcgi://127.0.0.1:####", host: "###:###:###:###:#####"
```

The server returns the error 500 to the method `pwg.images.uploadAsync`, as if an error was encountered during the transfer. The third party app concludes that the upload fails and might be repeated. 

Ideally, the server should return errors with codes different than a generic error 500 when a transfer fails, for example somthing like:
- 530 "error during buffer directory creation"
- 531 "MD5 checksum chunk file mismatched"
- 532 "error while creating merged…"
- 533 "error while locking merged…"
- 534 "error while merging chunk…"

This would prevent the third party app to allow re-uploading.
Crashes when uploading a photo that is already present
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : Crashes when uploading a photo that is already present
Issue date:

--- start body ---
Tested with Piwigo 14.1 and 14.2
When a photo already present on the server is re-uploaded, the server crashes with the following trace log:

```
2024/02/03 16:31:46 [error] 302#302: *399 FastCGI sent in stderr: "PHP message: PHP Fatal error: 
Uncaught mysqli_sql_exception: Duplicate entry '66-2' for key 'PRIMARY' in
include/dblayer/functions_mysqli.inc.php:132

Stack trace:
#0 include/dblayer/functions_mysqli.inc.php(132): mysqli->query()
#1 include/dblayer/functions_mysqli.inc.php(550): pwg_query()
#2 admin/include/functions.php(1914): mass_inserts()
#3 admin/include/functions_upload.inc.php(444): fill_lounge()
#4 admin/include/functions_upload.inc.php(179): add_uploaded_file_add_to_categories()
#5 include/ws_functions/pwg.images.php(1852): add_uploaded_file()
#6 include/ws_core.inc.php(600): ws_images_uploadAsync()
#7 include/ws_protocols/rest_handler.php(41): PwgServer->invoke()
#8 include/ws_core.inc.php(281): PwgRestRequestHandler->handleRequest()
#9 ws.php(22): PwgServer->run()
#10 {main}
  thrown in include/dbl" while reading response header from upstream, client: ###:###:###:###,
server: _, request: "POST /ws.php?format=json&method=pwg.images.uploadAsync HTTP/1.1",
upstream: "fastcgi://127.0.0.1:####", host: "###:###:###:###:#####"
```

The server returns the error 500 to the method `pwg.images.uploadAsync`, as if an error was encountered during the transfer. The third party app concludes that the upload fails and might be repeated. 

Ideally, the server should return errors with codes different than a generic error 500 when a transfer fails, for example somthing like:
- 530 "error during buffer directory creation"
- 531 "MD5 checksum chunk file mismatched"
- 532 "error while creating merged…"
- 533 "error while locking merged…"
- 534 "error while merging chunk…"

This would prevent the third party app to allow re-uploading.
--- end body ---

The issue indicates a potential Denial of Service (DoS) vulnerability in Piwigo versions 14.1 and 14.2, where the server crashes when attempting to re-upload a photo that already exists. The error is caused by a duplicate entry in the database, leading to a fatal error. This behavior can be exploited by an attacker to repeatedly crash the server by uploading existing photos, resulting in service disruption.