.. post:: :tags: TYPO3, Extbase
.. highlight:: php .. default-role:: code
:Project: TYPO3 CMS extension ext:upload_example for TYPO3 >= 6.2.4
:Author:
Helmut Hummel <helmut.hummel@typo3.org>__
:Repository:
At Github helhum/upload_example <https://github.com/helhum/upload_example>__
:Blogpost:
File Upload using Extbase and FAL in TYPO3 6.2 <http://insight.helhum.io/post/85015526410/file-upload-using-extbase-and-fal-in-typo3-6-2>__
:Credit:
- Anja Leichsenring <anja.leichsenring@typo3.org>__ - for pushing and motivating
- Stefan Frömken <froemken@gmail.com>__ - for handing over private code
- Martin Bless <martin@mbless.de>__ - for help with the documentation
Overview:
.. contents:: :local: :depth: 3 :backlinks: none
Version 6.2 of the Extbase framework has no support for file upload and image upload at all. This is a complete and working example claiming to do it it the right way.
- The heart of the extension is the UploadedFileReferenceConverter
- an extended FileReference model is needed
- an extended ObjectStorageConverter is needed
- an extended UploadViewHelper is needed
Everything else in this example extension is more or less plain code as generated by the extension builder.
We want to have a custom TypeConverter to:
- evaluate the file upload array
- move the uploaded file to a FAL storage using the FAL API
- and have the result persisted in the database using the Extbase persistence.
We don't want to just throw exceptions but use the TypeConverter API to return useful error messages to the user.
Things should be configurable, especially the TypeConverter. It needs to know about
- the folder to upload to
- what to do in case of a name conflict for the uploaded file
- the allowed file extensions
- how to deal with an already attached resource.
The actual configuration is done through by PropertyMappingConfiguration.
Some configuration options::
Case: Upload succeeds, validation fails ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In this case the file upload succeeds but due to validation errors in some other fields the whole form isn't accepted. This also means it isn't persisted yet but we nevertheless want to keep the uploaded file as a resource as we don't want to upload it again. Security -------- To make file upload secure the TypeConverter needs at least needs to care about these two issues: 1. Deny upload of PHP files! ::
It cannot be stressed enough how important these three lines of code are!
.. important::
- These lines are mandatory and NOT optional.
- These lines are independent from the configurable allowed file extensions.
- Get from Github, install as extension
- Create folder ./fileadmin/content
- No extra TypoScript needs to be included
- Create a page, insert the plugin as a content element
- Start playing in the frontend.
- Look into the controller to get an idea about how how to configure the type converter.
- Look into the TCA to see how to properly set the match_fields so that Extbase Persistence does the right thing.
- ...
-
Send pull requests to the repository. <https://github.com/helhum/upload_example>__ -
Use the issue tracker for feedback and discussions. <https://github.com/helhum/upload_example/issues>__
Enjoy!
