Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Current »

There are 2 ways of exposing uploaded file content:

  • insecure - location of uploaded file on server is exposed in the url
  • secure - only upload filename is exposed, but OnViewFile event is used to check access permissions to that file

By default insecure mode is used, because usually information, that is uploaded by users should be accessible to other users as well. However in some cases secure mode is preferred. Here is how both mode can be set from a unit config:

'Fields' => array(
	// secure
	'FieldName' => array('type' => 'string', 'direct_links' => false, 'default' => ''),
 
	// insecure (default, when 'direct_links' no specified)
	'FieldName' => array('type' => 'string', 'direct_links' => true, 'default' => ''),
),

Problem with secure mode is in fact, that developer can't change the way how link to a file is build and this code is hardcoded in kUploadFormatter class:

upload_formatter.php
$url_params = Array (
	'no_amp' => 1, 'pass' => 'm,'.$object->Prefix,
	$object->Prefix . '_event' => 'OnViewFile',
	'file' => rawurlencode($value), 'field' => $field_name
);

return $this->Application->HREF('', '', $url_params);

Need to ponder on how we can extract this logic and move it into more appropriate place, like EventHandler class.

  • No labels