Uploading A File

[jbearden0]

The context is I created a site 15 years ago using Mojolicious, ran into problems, and about 10 years ago I converted the site to use straight Plack with a lot of custom code. I've always meant to get back to using Mojolicious and occasionally I have time to work on that. The biggest obstacle for me is the documentation, and I know saying that ruffles a lot of feathers, but I pretty much always have to google answers about Mojolicious to find them on places like Stack Overflow. However I have run into a problem that I can't find an answer to googling so here I am.

The problem is I want to upload a file and the Mojolicious Tutorial page suggests this should be easy, with the content of the file included along with the other parameters I am submitting. However that is not the case and the name of the file type HTML form input is not included in the parameters. Below is code that I wrote 15 years ago to get around this problem, which loads a hash keyed by file name with the uploaded file(s) content. It does not work because I assume due to changes with Mojolicous internals over the last 15 years. I expect to have to just update this code, but before I do that I would like to ask if there is a better way. At this point in the code I have no idea what the input name might be, I just want to grab any files uploaded. If the file contents were included as a parameter then I wouldn't need this code at all.

`

my $ReqFiles;
if (defined $c->req->content->{parts}) {
  # Uploaded from HTML client
  my @Parts = @{$c->req->content->parts};
  for my $Part (@Parts) {
    for my $Item (keys %{$Part->headers->{headers}}) {
      if ($Item eq 'content-type') {
        my $File;
        my @Info = @{$Part->headers->{headers}->{$Item}};
        $File->{Type} = $Info[0][0];
        @Info = @{$Part->headers->{headers}->{'content-disposition'}};
        my @Chunks = split(/=/, $Info[0]);
        $File->{Name} = $Chunks[2];
        $File->{Name} =~ s/\"//g;

        $File->{Content} = '';
        if ($Part->{asset}->{content}) {
          $File->{Content} = $Part->{asset}->{content};
        } elsif ($Part->{asset}->{handle} && $Part->{asset}->{path}) {
          open(FILE, "<", $Part->{asset}->{path});
          for my $Line (<FILE>) { $File->{Content} .= $Line; }
          close(FILE);
        }

        if (length($File->{Content}) > $Config->{MAXREQSZ}) {
          $File->{Error} = 'UploadTooBig';
          $File->{Content} = '';
        } else {
          $File->{Content} = MIME::Base64::encode($File->{Content});
        }
        $ReqFiles->{$File->{Name}} = $File;
      }
    }
  }
}

`

[guest20]

post '/upload' => sub ($c) { 
  for ($c->req->uploads('the-field-name-from-your-mltipart/formdata-form') ){  # <- this is wrong see below
    $_->move_to( sprintf '/var/lib/myapp/upload/%s', $_->filename)
  }
};

[guest20]

@Grinnz boy howdy, that bug sure sounds like it could be quite a security issue in of my apps...

I guess I was thinking of ->param(...) that gets you the Mojo::Upload

[jbearden0]

I looked at the Tutorial documentation and it wasn't at all clear to me. It suggests the uploaded content is available via the "param" method and does not mention the Message "uploads" method (or "every_upload" method) at all. In my use case where I need to file contents I don't know the name of the input parameter so I honestly only tried using the params to_hash method, and it didn't show up there. So yeah, I think it would be super helpful for the tutorial to be updated to mention the information that you think it mentions. But this is just one example of many that I have had trying to get back into using mojolicious where, personally, the hardest part is beating information out of the documentation. It's usually easier to just google to see how other people have solved a similar problem, which usually results in some sort of hint as to what bits of the documentation might actually be helpful. In all fairness I am definitely not using mojolicious as I think most folks use it.

[guest20]

How did you come to be in a position where you don't know the details of the form being posted to your form handler?

If it's not in params at all, there's a good chance it's not in a form, and it's just the body if a put/post request instead ...

[jbearden0]

I'm pretty sure it's in a form, as the other inputs do show up in params. I have basically written a simple web version of Access, where all the forms, fields, some SQL queries, etc are stored in the database so (except for the occasional specialized logic) to add or update a form I just need to update the database. I also use gearman (although I plan on switching to minion) to actually process the request (which returns HTML, JSON, etc) and various other chores. So what I am working on right now is just a shim of a mojolicious app to pull the url, parameters, session, and files and then hand it off via gearman task to be processed. The shim has no idea about the data it is processing. I'm not using any templates and my only route is "any '/*' => sub ($c) ". I think I'm pretty much done with the shim now, and I'm just testing now before I roll it out to production.

[Grinnz]

The to_hash method will not include uploads, param returns uploads as a convenience if there is no parameter of that name. I can see how that would be confusing. For your case, you definitely need to look at the request "uploads" method since you don't know the parameter names.

[jbearden0]

Thanks everybody, I think the main issue was just getting confused by the documentation. I was looking at the request and content documentation but not the message documentation where the "uploads" method is mentioned. Once I found that it got a lot easier.

[Grinnz]

The best suggestion I can always give is search each of the guides for your use case first, it's a lot easier to find stuff there than the reference documentation which assumes you already know what objects you need to work with.