We have a public site that mimics the web2lead functionality but also includes the ability to upload a file (using inputFile). If a small file is attached and a validation error occurs, the page correctly displays the error messages and stops the processing. However, if a large ( > 1MB ) file is attached, when the Submit button is pressed, the system appears to be actually uploading the file before the validation errors occur. When this happens, the default sites Authorization Required page is displayed instead of the form. This is 100% reproducible. I've included the custom controller below. Any suggestions?

The site form is actually inside an iframe -- but I can reproduce the error by just bringing up the site page directly as well.

public class QprizeFormControllerExtension
{
/***********************************************************************************
Purpose: This class is the controller for the VF page QprizeForm
************************************************************************************/
public Lead NewLead {get; set;}
public Blob Businessfile {get; set;}
public String ContentType {get; set;}
public String FileName {get; set;}
public Integer Filesize {get; set;}
public boolean ValidationError{get; set;}

public QprizeFormControllerExtension()
{
NewLead = new Lead();
}

public pagereference SaveLeadnUploadFile()
{
ValidationError = false;
try
{
if(Businessfile == null || NewLead.Phone==null || NewLead.Competition_Rules_Regulations_Read__c == false || NewLead.General_Requirements_Read__c == false || NewLead.Company == '' || NewLead.CompanyLocation__c == null || NewLead.Street=='' || NewLead.City =='' || NewLead.PostalCode == null || NewLead.Company_Country__c == '' || NewLead.YearFounded__c == '' || NewLead.NumberOfEmployees == 0 || NewLead.BusinessSector__c == null || NewLead.Firstname == '' || NewLead.Lastname == '' || NewLead.Title =='' || NewLead.Email =='' || NewLead.BusinessDescription__c =='')
{
Businessfile = null;
ValidationError = true;
return null;
}
NewLead.LeadSource = 'Q-Prize 2009';

// Select the Active Lead Assignment Rule. There can only be 1 active rule
string id =[Select Name, Id From AssignmentRule where Active=true].id;
database.DMLOptions dmo = new database.DMLOptions();
dmo.AssignmentRuleHeader.assignmentRuleId=id;
dmo.AssignmentRuleHeader.useDefaultRule= false;
dmo.EmailHeader.triggerUserEmail = true;
dmo.EmailHeader.triggerAutoResponseEmail = true;
NewLead.setOptions(dmo);

insert NewLead;
System.debug('--Lead is created with ID: '+ Newlead.Id);

System.debug('****Businessfile '+ Businessfile);
if (Businessfile != null)
{
Attachment attach = new Attachment();
attach.Body = Businessfile;
attach.Name = FileName;
attach.ContentType = ContentType;
attach.ParentId = NewLead.id;
insert(attach);
System.debug('--Attachment is created with ID: '+ attach.Id);

}
} catch(System.DMLException e)
{
ApexPages.addmessages(e);
return null;
}

PageReference ConfirmationPage = new PageReference('http://qcventures.force.com/qprizeformconfirmation');

return ConfirmationPage;
}

//-------------------------Test Methods-------------------------------------------
public static testmethod void TestQprizecontroller()
{
Lead TestNewLead = new Lead();
TestNewLead.General_Requirements_Read__c = true;
TestNewLead.LeadSource = 'Q-Prize 2009';
TestNewLead.email = 'test@qualcomm.com';
TestNewLead.company = 'Qualcomm';
TestNewLead.Competition_Rules_Regulations_Read__c = true;
TestNewLead.General_Requirements_Read__c = true;
TestNewLead.Company = 'Qualcomm';
TestNewLead.CompanyLocation__c = 'San Diego';
TestNewLead.Street='Scranton Rd';
TestNewLead.City ='SD';
TestNewLead.PostalCode = '92121';
TestNewLead.Company_Country__c = 'USA';
TestNewLead.YearFounded__c = '1980';
TestNewLead.NumberOfEmployees = 9000;
TestNewLead.BusinessSector__c = 'Telecom';
TestNewLead.Firstname = 'Bob';
TestNewLead.Lastname = 'Smith';
TestNewLead.Title ='Mr';
testNewlead.Phone = '858-555-5555';
TestNewLead.Email ='bsmith@qualcommxx.com';
TestNewLead.BusinessDescription__c ='Test Desc';

QprizeFormControllerExtension Controller = new QprizeFormControllerExtension();
Blob NewFile = [Select body from Attachment limit 1].Body;
Controller.Businessfile = NewFile;
System.debug('****Controller.Businessfile '+ Controller.Businessfile);
Controller.FileName= 'TestFilename';
Controller.ContentType = 'ppt';
Controller.NewLead = TestNewLead;
PageReference SaveMethod = Controller.SaveLeadnUploadFile();

}
}