3 namespace Drupal\file\Element;
5 use Drupal\Component\Utility\Crypt;
6 use Drupal\Component\Utility\Html;
7 use Drupal\Component\Utility\NestedArray;
8 use Drupal\Core\Ajax\AjaxResponse;
9 use Drupal\Core\Ajax\ReplaceCommand;
10 use Drupal\Core\Form\FormStateInterface;
11 use Drupal\Core\Render\Element\FormElement;
12 use Drupal\Core\Site\Settings;
14 use Drupal\file\Entity\File;
15 use Symfony\Component\HttpFoundation\Request;
18 * Provides an AJAX/progress aware widget for uploading and saving a file.
20 * @FormElement("managed_file")
22 class ManagedFile extends FormElement {
27 public function getInfo() {
28 $class = get_class($this);
32 [$class, 'processManagedFile'],
34 '#element_validate' => [
35 [$class, 'validateManagedFile'],
38 [$class, 'preRenderManagedFile'],
40 '#theme' => 'file_managed_file',
41 '#theme_wrappers' => ['form_element'],
42 '#progress_indicator' => 'throbber',
43 '#progress_message' => NULL,
44 '#upload_validators' => [],
45 '#upload_location' => NULL,
50 'library' => ['file/drupal.file'],
59 public static function valueCallback(&$element, $input, FormStateInterface $form_state) {
60 // Find the current value of this field.
61 $fids = !empty($input['fids']) ? explode(' ', $input['fids']) : [];
62 foreach ($fids as $key => $fid) {
63 $fids[$key] = (int) $fid;
65 $force_default = FALSE;
67 // Process any input and save new uploads.
68 if ($input !== FALSE) {
69 $input['fids'] = $fids;
72 // Uploads take priority over all other values.
73 if ($files = file_managed_file_save_upload($element, $form_state)) {
74 if ($element['#multiple']) {
75 $fids = array_merge($fids, array_keys($files));
78 $fids = array_keys($files);
82 // Check for #filefield_value_callback values.
83 // Because FAPI does not allow multiple #value_callback values like it
84 // does for #element_validate and #process, this fills the missing
85 // functionality to allow File fields to be extended through FAPI.
86 if (isset($element['#file_value_callbacks'])) {
87 foreach ($element['#file_value_callbacks'] as $callback) {
88 $callback($element, $input, $form_state);
92 // Load files if the FIDs have changed to confirm they exist.
93 if (!empty($input['fids'])) {
95 foreach ($input['fids'] as $fid) {
96 if ($file = File::load($fid)) {
97 $fids[] = $file->id();
98 // Temporary files that belong to other users should never be
100 if ($file->isTemporary()) {
101 if ($file->getOwnerId() != \Drupal::currentUser()->id()) {
102 $force_default = TRUE;
105 // Since file ownership can't be determined for anonymous users,
106 // they are not allowed to reuse temporary files at all. But
107 // they do need to be able to reuse their own files from earlier
108 // submissions of the same form, so to allow that, check for the
109 // token added by $this->processManagedFile().
110 elseif (\Drupal::currentUser()->isAnonymous()) {
111 $token = NestedArray::getValue($form_state->getUserInput(), array_merge($element['#parents'], ['file_' . $file->id(), 'fid_token']));
112 if ($token !== Crypt::hmacBase64('file-' . $file->id(), \Drupal::service('private_key')->get() . Settings::getHashSalt())) {
113 $force_default = TRUE;
120 if ($force_default) {
127 // If there is no input or if the default value was requested above, use the
129 if ($input === FALSE || $force_default) {
130 if ($element['#extended']) {
131 $default_fids = isset($element['#default_value']['fids']) ? $element['#default_value']['fids'] : [];
132 $return = isset($element['#default_value']) ? $element['#default_value'] : ['fids' => []];
135 $default_fids = isset($element['#default_value']) ? $element['#default_value'] : [];
136 $return = ['fids' => []];
139 // Confirm that the file exists when used as a default value.
140 if (!empty($default_fids)) {
142 foreach ($default_fids as $fid) {
143 if ($file = File::load($fid)) {
144 $fids[] = $file->id();
150 $return['fids'] = $fids;
155 * #ajax callback for managed_file upload forms.
157 * This ajax callback takes care of the following things:
158 * - Ensures that broken requests due to too big files are caught.
159 * - Adds a class to the response to be able to highlight in the UI, that a
160 * new file got uploaded.
164 * @param \Drupal\Core\Form\FormStateInterface $form_state
166 * @param \Symfony\Component\HttpFoundation\Request $request
167 * The current request.
169 * @return \Drupal\Core\Ajax\AjaxResponse
170 * The ajax response of the ajax upload.
172 public static function uploadAjaxCallback(&$form, FormStateInterface &$form_state, Request $request) {
173 /** @var \Drupal\Core\Render\RendererInterface $renderer */
174 $renderer = \Drupal::service('renderer');
176 $form_parents = explode('/', $request->query->get('element_parents'));
178 // Retrieve the element to be rendered.
179 $form = NestedArray::getValue($form, $form_parents);
181 // Add the special AJAX class if a new file was added.
182 $current_file_count = $form_state->get('file_upload_delta_initial');
183 if (isset($form['#file_upload_delta']) && $current_file_count < $form['#file_upload_delta']) {
184 $form[$current_file_count]['#attributes']['class'][] = 'ajax-new-content';
186 // Otherwise just add the new content class on a placeholder.
188 $form['#suffix'] .= '<span class="ajax-new-content"></span>';
191 $status_messages = ['#type' => 'status_messages'];
192 $form['#prefix'] .= $renderer->renderRoot($status_messages);
193 $output = $renderer->renderRoot($form);
195 $response = new AjaxResponse();
196 $response->setAttachments($form['#attached']);
198 return $response->addCommand(new ReplaceCommand(NULL, $output));
202 * Render API callback: Expands the managed_file element type.
204 * Expands the file type to include Upload and Remove buttons, as well as
205 * support for a default value.
207 public static function processManagedFile(&$element, FormStateInterface $form_state, &$complete_form) {
209 // This is used sometimes so let's implode it just once.
210 $parents_prefix = implode('_', $element['#parents']);
212 $fids = isset($element['#value']['fids']) ? $element['#value']['fids'] : [];
214 // Set some default element properties.
215 $element['#progress_indicator'] = empty($element['#progress_indicator']) ? 'none' : $element['#progress_indicator'];
216 $element['#files'] = !empty($fids) ? File::loadMultiple($fids) : FALSE;
217 $element['#tree'] = TRUE;
219 // Generate a unique wrapper HTML ID.
220 $ajax_wrapper_id = Html::getUniqueId('ajax-wrapper');
223 'callback' => [get_called_class(), 'uploadAjaxCallback'],
226 'element_parents' => implode('/', $element['#array_parents']),
229 'wrapper' => $ajax_wrapper_id,
232 'type' => $element['#progress_indicator'],
233 'message' => $element['#progress_message'],
237 // Set up the buttons first since we need to check if they were clicked.
238 $element['upload_button'] = [
239 '#name' => $parents_prefix . '_upload_button',
241 '#value' => t('Upload'),
242 '#attributes' => ['class' => ['js-hide']],
244 '#submit' => ['file_managed_file_submit'],
245 '#limit_validation_errors' => [$element['#parents']],
246 '#ajax' => $ajax_settings,
250 // Force the progress indicator for the remove button to be either 'none' or
251 // 'throbber', even if the upload button is using something else.
252 $ajax_settings['progress']['type'] = ($element['#progress_indicator'] == 'none') ? 'none' : 'throbber';
253 $ajax_settings['progress']['message'] = NULL;
254 $ajax_settings['effect'] = 'none';
255 $element['remove_button'] = [
256 '#name' => $parents_prefix . '_remove_button',
258 '#value' => $element['#multiple'] ? t('Remove selected') : t('Remove'),
260 '#submit' => ['file_managed_file_submit'],
261 '#limit_validation_errors' => [$element['#parents']],
262 '#ajax' => $ajax_settings,
271 // Add progress bar support to the upload if possible.
272 if ($element['#progress_indicator'] == 'bar' && $implementation = file_progress_implementation()) {
273 $upload_progress_key = mt_rand();
275 if ($implementation == 'uploadprogress') {
276 $element['UPLOAD_IDENTIFIER'] = [
278 '#value' => $upload_progress_key,
279 '#attributes' => ['class' => ['file-progress']],
280 // Uploadprogress extension requires this field to be at the top of
285 elseif ($implementation == 'apc') {
286 $element['APC_UPLOAD_PROGRESS'] = [
288 '#value' => $upload_progress_key,
289 '#attributes' => ['class' => ['file-progress']],
290 // Uploadprogress extension requires this field to be at the top of
296 // Add the upload progress callback.
297 $element['upload_button']['#ajax']['progress']['url'] = Url::fromRoute('file.ajax_progress', ['key' => $upload_progress_key]);
300 // The file upload field itself.
301 $element['upload'] = [
302 '#name' => 'files[' . $parents_prefix . ']',
304 '#title' => t('Choose a file'),
305 '#title_display' => 'invisible',
306 '#size' => $element['#size'],
307 '#multiple' => $element['#multiple'],
308 '#theme_wrappers' => [],
310 '#error_no_message' => TRUE,
312 if (!empty($element['#accept'])) {
313 $element['upload']['#attributes'] = ['accept' => $element['#accept']];
316 if (!empty($fids) && $element['#files']) {
317 foreach ($element['#files'] as $delta => $file) {
319 '#theme' => 'file_link',
322 if ($element['#multiple']) {
323 $element['file_' . $delta]['selected'] = [
324 '#type' => 'checkbox',
325 '#title' => \Drupal::service('renderer')->renderPlain($file_link),
329 $element['file_' . $delta]['filename'] = $file_link + ['#weight' => -10];
331 // Anonymous users who have uploaded a temporary file need a
332 // non-session-based token added so $this->valueCallback() can check
333 // that they have permission to use this file on subsequent submissions
334 // of the same form (for example, after an Ajax upload or form
335 // validation error).
336 if ($file->isTemporary() && \Drupal::currentUser()->isAnonymous()) {
337 $element['file_' . $delta]['fid_token'] = [
339 '#value' => Crypt::hmacBase64('file-' . $delta, \Drupal::service('private_key')->get() . Settings::getHashSalt()),
345 // Add the extension list to the page as JavaScript settings.
346 if (isset($element['#upload_validators']['file_validate_extensions'][0])) {
347 $extension_list = implode(',', array_filter(explode(' ', $element['#upload_validators']['file_validate_extensions'][0])));
348 $element['upload']['#attached']['drupalSettings']['file']['elements']['#' . $element['#id']] = $extension_list;
351 // Let #id point to the file element, so the field label's 'for' corresponds
353 $element['#id'] = &$element['upload']['#id'];
355 // Prefix and suffix used for Ajax replacement.
356 $element['#prefix'] = '<div id="' . $ajax_wrapper_id . '">';
357 $element['#suffix'] = '</div>';
363 * Render API callback: Hides display of the upload or remove controls.
365 * Upload controls are hidden when a file is already uploaded. Remove controls
366 * are hidden when there is no file attached. Controls are hidden here instead
367 * of in \Drupal\file\Element\ManagedFile::processManagedFile(), because
368 * #access for these buttons depends on the managed_file element's #value. See
369 * the documentation of \Drupal\Core\Form\FormBuilderInterface::doBuildForm()
370 * for more detailed information about the relationship between #process,
371 * #value, and #access.
373 * Because #access is set here, it affects display only and does not prevent
374 * JavaScript or other untrusted code from submitting the form as though
375 * access were enabled. The form processing functions for these elements
376 * should not assume that the buttons can't be "clicked" just because they are
379 * @see \Drupal\file\Element\ManagedFile::processManagedFile()
380 * @see \Drupal\Core\Form\FormBuilderInterface::doBuildForm()
382 public static function preRenderManagedFile($element) {
383 // If we already have a file, we don't want to show the upload controls.
384 if (!empty($element['#value']['fids'])) {
385 if (!$element['#multiple']) {
386 $element['upload']['#access'] = FALSE;
387 $element['upload_button']['#access'] = FALSE;
390 // If we don't already have a file, there is nothing to remove.
392 $element['remove_button']['#access'] = FALSE;
398 * Render API callback: Validates the managed_file element.
400 public static function validateManagedFile(&$element, FormStateInterface $form_state, &$complete_form) {
401 $clicked_button = end($form_state->getTriggeringElement()['#parents']);
402 if ($clicked_button != 'remove_button' && !empty($element['fids']['#value'])) {
403 $fids = $element['fids']['#value'];
404 foreach ($fids as $fid) {
405 if ($file = File::load($fid)) {
406 // If referencing an existing file, only allow if there are existing
407 // references. This prevents unmanaged files from being deleted if
408 // this item were to be deleted. When files that are no longer in use
409 // are automatically marked as temporary (now disabled by default),
410 // it is not safe to reference a permanent file without usage. Adding
411 // a usage and then later on removing it again would delete the file,
412 // but it is unknown if and where it is currently referenced. However,
413 // when files are not marked temporary (and then removed)
414 // automatically, it is safe to add and remove usages, as it would
415 // simply return to the current state.
416 // @see https://www.drupal.org/node/2891902
417 if ($file->isPermanent() && \Drupal::config('file.settings')->get('make_unused_managed_files_temporary')) {
418 $references = static::fileUsage()->listUsage($file);
419 if (empty($references)) {
420 // We expect the field name placeholder value to be wrapped in t()
421 // here, so it won't be escaped again as it's already marked safe.
422 $form_state->setError($element, t('The file used in the @name field may not be referenced.', ['@name' => $element['#title']]));
427 // We expect the field name placeholder value to be wrapped in t()
428 // here, so it won't be escaped again as it's already marked safe.
429 $form_state->setError($element, t('The file referenced by the @name field does not exist.', ['@name' => $element['#title']]));
434 // Check required property based on the FID.
435 if ($element['#required'] && empty($element['fids']['#value']) && !in_array($clicked_button, ['upload_button', 'remove_button'])) {
436 // We expect the field name placeholder value to be wrapped in t()
437 // here, so it won't be escaped again as it's already marked safe.
438 $form_state->setError($element, t('@name field is required.', ['@name' => $element['#title']]));
441 // Consolidate the array value of this field to array of FIDs.
442 if (!$element['#extended']) {
443 $form_state->setValueForElement($element, $element['fids']['#value']);
448 * Wraps the file usage service.
450 * @return \Drupal\file\FileUsage\FileUsageInterface
452 protected static function fileUsage() {
453 return \Drupal::service('file.usage');