file_save_upload() displays status messages when files are renamed during upload:
These messages provide no actionable value. The upload succeeded and users cannot undo the rename. They just clutter the UI, especially in modals like the media library.
Remove these messages.
No more "renamed" status messages on file upload.
Before:
After:
| Comment | File | Size | Author |
|---|---|---|---|
| #18 | 3563051-18.diff | 12.94 KB | jvollebregt-swis |
| #6 | 3563051-10.6.x-file_rename_remove_status_messages.patch | 11.12 KB | stephaneq |
| #3 | Screenshot 2025-12-14 at 2.36.26 pm.png | 63.58 KB | pameeela |
| #3 | Screenshot 2025-12-14 at 2.04.01 pm.png | 75.45 KB | pameeela |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes, plain diff MR !14108
Comments
Comment #3
pameeela commentedStrongly agree with this change, I flagged it for removal in Drupal CMS if we can't get this into core. Manually tested and added screenshots to core, I think it's clear why this is a problem when you see the media modal. As the IS already says, there is nothing actionable, and the actual name of the file is not useful information for the user. Not to mention that the user is in the middle of a separate task that needs to be completed, so the green status message is very confusing.
I'm guessing this was added in the days before media where the feedback made a bit more sense in the context of a direct file upload, but even then it is not useful.
Comment #4
pameeela commentedComment #5
phenaproximaNot a stable blocker for us, we will shim around it in #3563050: Sanitising of filenames adds an annoying status message on upload. But certainly a release target.
Comment #6
stephaneqOne of my clients found this annoying, so I created a patch based on the MR for Drupal 10.6. I’m sharing it here for anyone who might be interested (applied and tested on D 10.5.x and 10.6.x).
Comment #7
longwaveI checked back and the message was refactored in #3032390: Add an event to sanitize filenames during upload - previously it only displayed if the file was renamed for security reasons. The original message dates back to #693084: Regression: file_munge_filename() extension handling broken by move to File Field which was added as a security improvement.
While showing the message to the user feels a bit pointless, given this is security related I'm wondering if we should keep the
->isSecurityRename()check and send it to watchdog in this case - is that worthwhile?Comment #9
catchMoving back to needs review for #7, I can see arguments both ways for the logging. On d.o there are plenty of 'unsafe' file uploads that were renamed but we know they weren't malicious and lots of the people who uploaded them wouldn't have been surprised that the extension got renamed. So I guess it comes down to how often we think people would maliciously try to do this which I have no idea, and whether the logging would help to spot that someone was doing it.
Comment #10
lauriiiI don't think it hurts to put the security logging back. Added back to the MR 👍
Comment #11
smustgrave commentedBelieve the feedback for this one was addressed. Restoring RTBC
Comment #13
longwaveAs a minor behaviour change this can only go in a minor release, so this will be in 11.4.0.
Committed and pushed 61c592bf375 to main and 49348ee133f to 11.x. Thanks!
Comment #18
jvollebregt-swis commentedHere's a patch for the old 11.x branch version for people using composer patches. Applies on 11.2