Problem/Motivation
As part of #3221796: [META] Modernise file upload logic it was identified CKEditor5ImageController duplicates a lot of logic in FileUploadHandler. This has lead to bugs like #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.
In order to reduce the chances of bugs like this happening, we should make CKEditor5ImageController reuse FileUploadHandler.
Steps to reproduce
Proposed resolution
make CKEditor5ImageController reuse FileUploadHandler.
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
Issue fork drupal-3388985
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
kim.pepperComment #4
kim.pepperChanged CKEditor5ImageController to use FileUploadHandler.
I needed to add two things to FileUploadHandler to support this:
\Drupal\Core\File\FileSystemInterface::prepareDirectory()to create the destination sub-directory\Drupal\Core\Lock\LockBackendInterface::acquire()/::release()which gets duplicated by JSON API and REST too, so we can move more logic to shared code in #3375423: Deprecate file_managed_file_save_upload(), file_save_upload() and _file_save_upload_from_form() and replace with a serviceComment #5
kim.pepperI rolled back the changes to FileUploadHandler.
Probably the most complex bc handling constructor I have tried so far.
Created a new issue for #3389016: Add file upload lock handling to FileUploadHandler
Comment #6
smustgrave commentedSeems failure could be related to change.
Comment #7
kim.pepperComment #8
smustgrave commentedSweet seeing all green! Tagging for CR
Comment #9
kim.pepperUpdated change record.
Comment #10
smustgrave commentedThanks @kim.pepper reads well.
Comment #11
wim leersI didn't notice this because it's not in the component that the code actually lives in 😅
Comment #12
wim leersLooks fantastic!
But, 2 questions, one of which is a bug in the logic (although it does not currently cause problems, hence the passing tests, but it'll make future maintenance more difficult/confusing).
Comment #13
wim leersWould this make #3246260: Simplify CKEditor5ImageController once #2940383 lands obsolete too, or is that a further evolution of Drupal core's file upload handling?
Comment #14
kim.pepperAddressed all feedback.
Comment #15
smustgrave commentedAll threads have been resolved.
Comment #16
smustgrave commentedSave credit to @Wim Leers for his review.
Comment #17
wim leersRTBC++
Comment #18
kim.pepperI think we should postpone on #3375447: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface as we won't need to do the exception handling.
Comment #19
kim.pepperComment #20
kim.pepperComment #21
larowlanBlocker is in
Comment #22
kim.pepperUpdated to use constraint violations.
Comment #23
kim.pepperPostponing #3389016: Add file upload lock handling to FileUploadHandler on this.
Comment #24
smustgrave commentedDeprecation seems correct
CR is present and makes sense about what is now needed.
Comment #25
wim leersReviewed this in detail. It looks excellent :)
We have detailed test coverage for this:
\Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testUploadFileExtension()\Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testFileUploadLargerFileSize()\Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testLockAfterFailedValidation()(Note that each of these asserts a 422 response is received when trying to upload something that is not allowed 👍
That's why I can confidently confirm this RTBC 😊
Comment #26
larowlanJust one minor issue with the deprecation messages
Comment #27
kim.pepperBack to RTBC (assuming green).
Comment #28
longwaveWhile this is RTBC it is only a refactoring; #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… is a major feature request that wants to make changes to the controller constructor as well, and I think it is worth postponing this issue on that one in order to try and get that into 10.2.x first; this can only go into 10.3.x/11.x as the parent issue did not land in 10.2.x.
Comment #29
kim.pepperWell, this is disappointing given its blocked on a feature request, while this is removing duplicate code which has been the cause of numerous bugs (including security issues).
I would argue this has higher priority.
Comment #30
larowlanYes, this fixes #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.
But because it relies on code from the parent issue that is 10.2 we're kind of hamstrung.
We might need to unpostpone #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file. and reinstate the old approach there
Comment #31
wim leersI think there's been a misunderstanding here. #3375447: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface did not actually land only in
11.x… because10.2.xwas branched from11.xAFTER #3375447 landed! That is the confusing part here 😅EDIT: I realized this only yesterday, at #3280279-53: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG….
So: moving back to RTBC: this can land first just fine (and I think @kim.pepper's reasons above are sufficiently convincing — tagging accordingly), and then we can land the #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… afterwards 👍
Comment #32
longwaveNot at computer to check but that is not what I remember nor what #3375447-26: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface says... which is why I would prefer to get the other issue in first before diverging 10.2.x and 10.3.x/11.x any further.
Comment #33
larowlanSee https://www.drupal.org/project/drupal/issues/3375447#comment-15284269 the other issue was 11.x only, I confirmed with git
I'll unpostpone #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.
I don't think we should postpone this on the feature addition though, this is a nice piece of cleanup for 11.x part of a larger string of criticals that consolidate file upload handling.
Comment #34
quietone commentedI read the issue summary and the comments. I did not find any unanswered questions or other work to do. I also think the change record is correct.
Comment #36
larowlanWent to commit #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… first but it has a phpcs fail.
So this one wins the 'who goes in first' prize.
Committed to 11.x and published change record.
Unpostponed #3389016: Add file upload lock handling to FileUploadHandler
Comment #43
lendudeSince FileUploadHandler doesn't have an interface and this plugin now hardcodes the used class, you can no longer decorate the file.upload_handler service and use this plugin without fatal errors ¯\_(ツ)_/¯
Comment #44
larowlanThat seems worth an issue to add an interface
Comment #45
kim.pepperCreated #3490549: Add an interface for FileUploadHandler