How can I validate and debug file uploads?

Written Oct 12, 2012 09:01

ChronoForms has two built-in ways to validate file uploads. You must specify the type or types of file that you allow, and the maximum and minimum size of uploads.

Specify the file types

In the Upload Files action Fields Configuration box you have to enter the file upload input name and a list of allowable file types. For example:

input_file_1:doc-docx-pdf

The input name here must match the name of the File Upload element in your form.

If you scroll down the box you can set the error message to be used if there is a validation error with the file type.

If you have more than one File Upload element then you can add a comma separated list (with no spaces between entries)

input_file_1:doc-docx-pdf,input_file_2:jpg-png

There is no 'wild-card' file type entry here; you must include an entry for any file-type that you want to permit. This is because allowing an 'open' upload leaves you open to potentially malicious files being uploaded. It is best to keep this list as tight as you practically can.

Specify the file-size

Use the two boxes in the Upload Files action configuration 'Max Size in KB' and 'Min Size in KB' to set the allowable file sizes. There are boxes below where you can set the error messages to be used.

Note that there may be other limits on file sizes set by your web host in your php.ini file that limit the size of files that can be uploaded. ChronoForms does not check these and it is up to you to make sure that the server settings are OK. In particular check the max_upload_size setting. You can see this in the Site Admin | System Information | PHP Information page. You may need to check your web host's help documentation if this setting needs to be changed.

Select a 'safe' file name

At the bottom of the Settings tab is an option to set a 'Safe' file name. By default this is set to yes and will strip out any special characters and spaces from the name of the uploaded file. This makes sure that the name that can safely be used on the internet as a link. For more info see the Joomla! JFile::makeSafe() method.

ChronoForms does not let you specify a file name. It will use the uploaded file name prefixed with a date+time string to make sure that files don't get over-written by later uploads with the same name.

If you want more control over the File Name (and some other options) please see my custom {rokbox text=|Upload Fles [GH] action| size=|1000,600| }http://greyhead.net/how-to-docs/cfv4-upload-files-gh-action{/rokbox}.

Array fields

If you are using array field names for your file uploads like name='input_file[]' then you need to identify these on the Upload Files action Advanced tab. This is because of the way that these files are organised in the PHP $_FILES array after they have been uploaded.

Normally you will not need to use this but array names can be useful if you are using PHP or JavaScript to create multiple upload file elements.

Set the OnFail action

Lastly you need to set the action ChronoForms should take if there are errors found with the file upload. Usually you will need to drag an Event Loop action into the pink On Fail event of the Upload Files action. Leave the default settings of Target Event : > OnLoad and Quit Next Actions: Yes

If you do not add this action the File Uploads will still be processed but any errors will be ignored and this could cause risks for your site security.

Checking permissions

To allow ChronoForms to Upload files successfully the upload folder that you specify must be accessible and writeable. Normally a chmod setting of 755 is what is needed. If in doubt please check with your web host's help documents.

You probably do not want to upload files to the site root folder or any other important Joomla! folder as these folders hould not be writable to protect your site security. Use a folder that is only used for uploads.

Note that if you have FTP enabled in your Site Global Configuration then Joomla! and ChronoForms will try to use FTP to move uploaded files. Sometimes the server identifies different users for Joomla! and for FTP and these users may have different permissions. (These are server users - not Joomla! users.) If you see JFolder or JFile errors reported please check that FTP is disabled and test again to see if this resolves the problem.

Debugging file uploads

If you drag a Debugger action into the form On Submit event and then submit the form including a file upload you should see two sets of debug reports about the files.

The process of uploading files from a ChronoForm is that first PHP uploads them to a temporary folder; then ChronoForms validates the files and, if the validation is successful, moves renamed copies to the Upload folder you have specified.

The PHP $_FILES array will be shown which gives you details of the uploaded files and will show an Error Code for any errors found in the initial upload process. You can see more information on the PHP errors in the PHP manual here.
The Debug entries from the Upload Files action will be shown which will tell you if ChronoForms was able to validate and move the files correctly.

If you do not see these entries in the Debugger code please check:

That the <form> tags for your form include enctype='mulitpart/form-data' Normally ChronoForms will add these automatically if there is a File Upload element in the form but it may not do so if you are using custom HTML. You can add this in the Form Tag attachment box on the Form General tab.
That the Upload Files action is enabled - the first option is a Yes/No setting.
That the names in the Fields Configuration box exactly match the names of the corresponding file upload elements (you can see these names in the debug report).
Check the path names that are show carefully to check that there are no typos, missing slashes or doubled slashes //
Check the upload folder to see if there are any files there and what the folder permissions are (see above).

FAQs