Frontend uploads are not inside the Contao root dir

[rabauss]

Unfortunately, for us the uploads in the frontend are not working properly anymore, because files are uploaded to a temporary folder which is not inside the contao root. Because of that the following line will throw an error "/tmp/phpAbc" is not inside the Contao root dir "xyz/contao"

https://github.com/numero2/contao-proper-filenames/blob/ee2812a521eeea7ce416a4e9f9ef53ea62671709/src/Resources/contao/classes/CheckFilenames.php#L104

Has anyone else the same problems or is there a solution to disable the proper filenames for the frontend forms?

[rabauss]

Oh I see there was a related but closed issue https://github.com/numero2/contao-proper-filenames/issues/9 We also use the core upload in a form from the generator!

[bennyborn]

As stated in #9

The Cores widget should always report a tmp_name that's inside TL_ROOT

Maybe @fritzmg could tell us what the problem was in his Installation since this one seems similar?

[rabauss]

Okay, the upload path did not exist in my local dev environment 😭 Because of that the tmp_name is not overwritten here: https://github.com/contao/contao/blob/4.9/core-bundle/src/Resources/contao/forms/FormFileUpload.php#L291

Although I wonder why we have some error logs in our productive system Path \"files/upload\" is not inside the Contao root dir and there the path exists! Maybe I can debug that...

[rabauss]

I cannot reproduce the error in my local environment - so I'm closing this issue for now and need to observe if the error logs continue in our prod system.

[bennyborn]

Thanks @rabauss 🎉

I just made a new release that catches the exception and also adds a checkbox to the backend to prevent certain upload fields from being sanitized at all (if needed).