Form

File component - Upload single or multiple files

File upload(s) stored as Attachments

Releases

1.2

• Fixed (multi) file upload retrieval for backend, portal and public forms (request context/env).
  This applies to GET /formio/storage/filestore requests immediately after the upload, e.g. to preview images, that resulted in HTTP 403 Forbidden errors.
  This required to fixing and improving the URL/route authentication checks.
  Also done another security audit, so uploaded files cannot be retrieved without proper access/permission.

1.1

• Improve public user check, by checking either:
  - no user in request.env, or ...
  - the request user has the public user group (the added check).
  This change isn't solving a vulnerability, but a public GET request was too restrictive and could be denied too quickly.

1.0

• Fix security vulnerability for GET (file) request.
  The form access-check was missing here, which determines whether the (file) request is allowed or forbidden.
  Even though those file requests are obscured by a UUID (unique randomized) string in the file name, those were still publicly accessible before this fix.

0.10

• Fix: ValueError Expected singleton: formio.form(), when write on multi recordset.

0.9

• Fix: file component inside datagrid, attachment not linked with formio.form
• Improve attachment(s) check to allow unlink.

0.8

• Fix: Wizard (mode) doesn't store/link the ir.attachment properly.

0.7

• Fix: Deletion of other attachments was impossible due to a rigorous record rule, introduced in 0.4
  - Removed the Record Rule (XML ID): ir_attachment_unlink_formio_form_storage_filestore
  - Implement unlink method in the ir.attachment model, which raises an error (message) upon deletion of attachments beloning to submitted Form(s).
  - Implement unlink method in the formio.form model, which handles (kinda) cascade deletion of attachments upon deleting Form(s).

0.6

• Improvement: Only process a Form its filestore/attachments upon saving submission data.

0.5

• Fix: Upon write of Form only delete orphaned attachments/files concerning this module.

0.4

• Add record rule: Files in completed Forms cannot be deleted.
  This ensures uploaded files (in a completed Form) cannot be deleted.

0.3

• Security measurement for public POST request, checking the Formio baseUrl (UUID).
  Because CSRF is disabled (needed) for this endpoint.

0.2

• Scheduled action (daily cron) which deletes pending Attachments (e.g. file uploads) for Forms never submitted.

0.1

• Initial draft release.