wwwision/form-securefileupload

Last activity on 6 June 2020
  • 1
  • 1
  • 117
composer require wwwision/form-securefileupload

Flow package with examples and helpers to implement secure form uploads

1.0.1

Flow package with examples and helpers to implement secure form uploads

Version
1.0.1
Type
neos-package
Release Date
Jun 30, 2020 2:11:48 p.m.
Source
git
Distribution
zip
Requires
Requires (dev)
None
Suggest
None
Provides
None
Conflicts
None
Replaces
None
MIT e46144e9ac19465a69f0caa9598c4381f707691a

Wwwision.Form.SecureFileUpload

Flow package with examples and helpers to implement secure form uploads

Description

When using the default FileUpload element of the Flow Form Framework instances of PersistentResource are created in the default (persistent) resource collection that creates publicly accessible URLs for each resource. This package configures all FileUpload fields to use a new resource collection formUploads that uses "private resources" provided by the wwwision/privateresources package.

This also contains a Form finisher that removes uploaded resources once they have been processed or sent via email for example.

Installation

composer require wwwision/form-securefileupload

Usage

By installing this package, files that are uploaded via the FileUpload form element are automatically stored in the protected formUploads resource collection.

Cleanup uploaded files

With this package, uploaded files are no longer accessible from the "outside" without a valid token (see https://github.com/bwaidelich/Wwwision.PrivateResources). However, they are still persisted in the servers filesystem (by default) and referenced via the neos_flow_resourcemanagement_persistentresource database table.

In order to remove uploaded files after they have been processed, the provided RemoveUploads finisher can be used.

From the form definition (yaml):

type: 'Neos.Form:Form'
identifier: 'contact'
label: 'Contact form'
renderables:
  -
    type: 'Neos.Form:Page'
    identifier: 'page-one'
    # renderables: ...
finishers:
  -
    # process uploads (e.g. send via email)
    identifier: 'Neos.Form:Email'
    options:
      attachAllPersistentResources: true
      # ...
  -
    # delete persistent resources
    identifier: 'Wwwision.Form.SecureFileUpload:RemoveUploadsFinisher'

Note: In the current implementation the RemoveUploads finisher iterates over all form elements and deletes all instances of PersistentResource. For a more fine granular behavior you should create a custom finisher (or send a pull request my way *g)

Form Builder

This package can be used with the neos/form-builder package of course. In order to be able to attach the finisher from the backend, a corresponding Node Type and fusion definition is required:

NodeTypes.yaml:

'Your.Package:RemoveUploadsFinisher':
  superTypes:
    'Neos.Form.Builder:AbstractFinisher': true
  ui:
    label: 'Remove Uploads Finisher'
    icon: 'icon-trash'

root.fusion:

prototype(Your.Package:RemoveUploadsFinisher.Definition) < prototype(Neos.Form.Builder:Finisher.Definition) {
    formElementType = 'Wwwision.Form.SecureFileUpload:Finisher.RemoveUploads'
}
The content of the readme is provided by Github
The same vendor provides 20 package(s).