Protected attachment urls and FileUpload don't go well together when attachOnUpload is false
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 1.5k
- Forks
- 246
- Avg merge
- 19h 2m
- Merged PRs (30d)
- 7
Description
Winter CMS Build
1.2
PHP Version
8.2
Database engine
MySQL/MariaDB
Plugins installed
No response
Issue description
WinterCMS: v1.2.10
Hi,
Attaching a protected file via the FileUpload form widget and clicking directly on the attachment url before saving returns 404.
It doesn't happen using attachOnUpload: true. I think that's due to deferred bindings. Maybe the preview should be enabled once the form is saved.
Steps to replicate
- Setup a protected attachment in your model.
- Use
FileUploadform widget to upload it. - Try to preview the uploaded file before saving.
Workaround
The workaround is to set attachOnUpload: true so that the file is immediately linked to the model after the upload.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the FileUpload form widget and its handling of protected attachments, especially the attachOnUpload and deferred-binding paths. Reproduce the upload and pre-save preview steps, then trace why the attachment URL returns 404. Done should prevent the reported 404 or establish the intended preview behavior, with regression coverage for the protected upload case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- laravel, php
- Domain
- backend, web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100