Skip to content

Some small fixes for upload files article #5571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 5, 2015
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions cookbook/controller/upload_file.rst
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ Finally, you need to update the code of the controller that handles the form::
if ($form->isValid()) {
// $file stores the uploaded PDF file
/** @var Symfony\Component\HttpFoundation\File\UploadedFile $file */
$file = $product->getBrochure()
$file = $product->getBrochure();

// Generate a unique name for the file before saving it
$fileName = md5(uniqid()).'.'.$file->guessExtension();
Expand All @@ -135,13 +135,13 @@ Finally, you need to update the code of the controller that handles the form::
// instead of its contents
$product->setBrochure($filename);

// persist the $product variable or any other work...
// ... persist the $product variable or any other work

return $this->redirect($this->generateUrl('app_product_list'));
}

return $this->render('product/new.html.twig', array(
'form' => $form->createView()
'form' => $form->createView(),
));
}
}
Expand All @@ -150,10 +150,10 @@ There are some important things to consider in the code of the above controller:

#. When the form is uploaded, the ``brochure`` property contains the whole PDF
file contents. Since this property stores just the file name, you must set
its new value before persisting the changes of the entity.
its new value before persisting the changes of the entity;
#. In Symfony applications, uploaded files are objects of the
:class:`Symfony\\Component\\HttpFoundation\\File\\UploadedFile` class, which
provides methods for the most common operations when dealing with uploaded files.
provides methods for the most common operations when dealing with uploaded files;
#. A well-known security best practice is to never trust the input provided by
users. This also applies to the files uploaded by your visitors. The ``Uploaded``
class provides methods to get the original file extension (:method:`Symfony\\Component\\HttpFoundation\\File\\UploadedFile::getExtension`),
Expand All @@ -162,7 +162,7 @@ There are some important things to consider in the code of the above controller:
However, they are considered *not safe* because a malicious user could tamper
that information. That's why it's always better to generate a unique name and
use the :method:`Symfony\\Component\\HttpFoundation\\File\\UploadedFile::guessExtension`
method to let Symfony guess the right extension according to the file MIME type.
method to let Symfony guess the right extension according to the file MIME type;
#. The ``UploadedFile`` class also provides a :method:`Symfony\\Component\\HttpFoundation\\File\\UploadedFile::move`
method to store the file in its intended directory. Defining this directory
path as an application configuration option is considered a good practice that
Expand Down