Closed (fixed)
Project:
FileField
Version:
6.x-3.1
Component:
Code
Priority:
Normal
Category:
Support request
Assigned:
Unassigned
Reporter:
Created:
17 Jul 2009 at 13:05 UTC
Updated:
23 Jul 2009 at 15:55 UTC
How does filefield ensure the integrity of uploaded files? How does filefield or Drupal core check to make sure a file upload has been completed or not corrupted in the process?
Comments
Comment #1
quicksketchFileField (and Drupal core) currently do not offer true integrity checks on uploaded files. Typically, such validation is done through MD5 hashes (or some other hash) on the contents of the file before upload, then after upload the hash is generated again and the two are compared for equality. However, HTTP (as far as I'm aware) does not offer any way to get such a hash, so truly ensuring absolute equality between the original and the upload is a difficult problem to solve.
There are some other options available for at least checking if a file is completely uploaded, at least in the case of using progress bars, the full file size is reported to FileField during the upload. So the final size can at least be compared to the size reported by uploadprogress. However, I'm not sure this is even necessary, because FileField uploads to the temporary directory until the file is completed. Then after (and only after) the complete file is uploaded, the file is moved from the temporary directory to it's final location. In the case of an interrupted or incomplete upload, the file is never moved from the temporary location to final location.
So in short, completeness of upload is ensured as far as PHP can provide us. I know that Flash uploaders do additional checks when dealing with any upload as part of Flash's uploading capabilities, since they have the advantage of being able to do such checksums on the client-side before the upload begins. But it's unlikely that FileField will natively support Flash because of compatibility, licensing, and community familiarity with the platform.
Comment #2
bsnodgrass commentedThanks for the information. As always it's important to understand limitations so assumptions aren't made.
Comment #3
trailerparkopera commented