Why renaming uploaded files ?

[squarou]

Hello,
I'm playing with your awesome CRUD admin interface, building a news/blog editor interface.
My users will need to attach some files to their posts. I'm using the upload_multiple field by all the filenames are renamed following the uploadMultipleFilesToDisk function.
So my question is why is it the default behavior ? Is there a reason the renaming process is not optional ?

Thanks for your answer.

NB : is there a way to build my own function to disable renaming ?

[pxpm]

@squarou just write your own uploadMultipleFilesToDisk in your model.

You can check original function here: https://github.com/Laravel-Backpack/CRUD/blob/91a8093ad1e55ad329d74994eaa2ed943fb0ec6a/src/app/Models/Traits/HasUploadFields.php#L76

[squarou]

Hey @pxpm I just did it ! Thank you.

I created a custom trait based on CRUD's HasUploadFields trait, renamed the function and changed the line
$new_file_name = md5($file->getClientOriginalName().random_int(1, 9999).time()).'.'.$file->getClientOriginalExtension();
to
$new_file_name = Str::slug($file->getClientOriginalName(), '-').'.'.$file->getClientOriginalExtension();

[pxpm]

Just an heads up, you don't need to create a custom trait. You just need to create the same function, with the same name in your model. That function will be called instead of the function in the Backpack trait.

[squarou]

Ok thanks for the precision !

[tabacitu]

To provide more insight into our reasons to do this by default - personally I think that's what 99% of the devs should be doing, because:

• it provides "security through obscurity"; there's little chance someone will guess a file name;
• it heavily decreases the odds of trying to upload two files with the same name;

I think it's one of those things that's super-simple to do, and prevents problems down the line.

[squarou]

Yes, I understand the reason you explain and globaly agree. But in my use case, I don't think there's a security weakness (or I don't see it) because the files are attached to an article in order to be downloaded by everyone. So there's nothing to "hide"
Secondly, I need the filename to be SEO friendly and by experience md5 filename are not semantic. By the way, when I was testing the upload_multiple field, I uploaded a few tests files and once the form was saved the filename were md5 => on the edit form I did not remember wich file were uploaded 😅 That's why I was looking for a (simple) method to keep and clean the filenames.

Let me know is there's some serious security breach.