Thanks. Yes it is Bob's add-on i'm using. The file upload would be on the public facing front end of the site, it's for visitors to upload images, so is it necessary to specify user groups?
Never used it before so might be best to see if Bob comes along to give you an official answer, however, my own opinion would be yes due to security reasons, you don't want just anybody coming along and uploading anything that can harm the site / server
-
☆ A M B ☆
- 24,524 Posts
Ok, cheers, i picked up the security considerations to take into account when looking into this. Just to elaborate, the file upload feature is to be used on a 'comment' section for blog posts (i'm using Articles and Quip). So visitors leaving a comment can also upload a picture, relating to say their vacation which is what the website is about. I also need another file upload feature on a different site being built which will be for the purposes of uploading artwork files for an Online print store, although on that site i haven't got to that part yet. I wouldn't know any PHP whatsoever, or else i'd just create a standard upload form and place it on the page, and use the appropriate snippets etc. inside Revo.
Oh, and any images uploaded as part of a comment would presumably be sent into the manager, and then need to be approved by the moderator.
-
☆ A M B ☆
- 1,780 Posts
I don't believe user groups are necessary for FileUpload to work, however the path or &makedir parameter is essential. It does also deserve to be noted again, if anyone can upload... bad anyones can upload too. Really scary idea allowing anyone to put files on your server IMO.
Some things I've noted:
- Make sure to edit the snippet call in text or html view. Not rich text. That can gork a snippet call.
- Along the same lines, check your back ticks. They should not be ticks, but make sure to use the back tick under the tilde on your keyboard. Also, check for any incorrectly placed back ticks. I found one preceding a parameter and it absolutely wonked the path.
- Check the slashes, FileUpload path needs a trailing slash, with no preceding slash. If the directory isn't created, it won't find it with &path=.
- Check spacing of the paramaters in the snippet call. Spacing can gork it.
- Check for any &: in text or html view and turn them back into & preceding the parameter. I know MODX is supposed to read these properly, but it's worth changing if they got converted by a rich text editor.
-
☆ A M B ☆
- 1,780 Posts
Oops, that took too long to get posted.
So, if this is for an image, make sure to exclude all other file types. That should save your server. However, bear in mind that this snippet makes the file upload to the selected path. This means, even if the comment is not approved, the uploaded file will be in the directory, on your server.
Making the file type only allow .jpg, and also limiting the file size would be helpful for security.
As far as using "standard" snippets for Revo, FileUpload would be a standard snippet/extra. Amongst a couple others IIRC. Writing new snippets is silly when Bob and others have put the time into them already. They can always be modified as well.
Ok, cheers guys. I'm about to go thru these responses in much more detail but the first things that stand out- it's bad to allow anyone to upload files to a server, so how does every Online print store on the planet deal with the public uploading 'files' to their site? (large artwork files to be printed). And what is IIRC? I know snippets can be modified but i'm not a developer and couldn't decipher a line of PHP / read or write it for all the tea in China. Thanks again, i'm going to study this and see if i can achieve my goal here.
