Renaming file via url query params

[theMackabu]

Is it possible, to rename the file via URL query params, or keep the original filename in the collection instead of the long generated string? Thanks in advanced!

[ganigeorgiev]

No, at the moment users are not allowed to change the uploaded file name.

Using a unique random string for filenames have several benefits:

• it eliminates the possibility of any filename text related vulnerabilities (like path traversal, xss injections when serving the file, etc.)
• it allow us to not worry about duplicated names (uploading a new file will never collide with existing one)
• it allow us to not worry about browser caches when "replacing" a file since the new one will always have a new name
• it helps keeping your files "private" and accessible only if you know the url (in future there will be also auth-only/password protected files)

If you want to keep the original file name (or any other meta data), you could add additional field(s) in your collection (eg. filename) and set the field value with the original name when uploading the file.

[ByScripts]

It would be great to be able to pass the desired filename as query string parameter or based on another field in DB.

Either this: http://host/api/files/<collectionId>/<recordId>/<fileName>.pdf?name=MyCustomName

Or a custom DB field for storing the name and an option in the configuration of the file field for selecting the "name" field.

Example:

[ganigeorgiev]

@ByScripts Hi, I'm not planning to support custom filenames out of the box since the pros of generated names outweigh the cons and there are already workarounds for the cases where you really need custom file names. You could also check #306.

[ganigeorgiev]

Since this is a common request, I'll consider implementing a mixed approach - 8 characters random string + the original file name (trimmed and normalized), aka. it will look something like xpng9ihd_original_file_name.png.

[ByScripts]

I understand all the pros of generated names, and I'm not questioning that.

But on client side, what would be the cons of just having a ?name=myCustomName in URL? Since the original extension would be kept. (which would set the header to, for example, Content-Disposition: inline; filename="myCustomName.pdf")

[ganigeorgiev]

Allowing users to supply the filename attribute value could lead to RFD and XSS attacks and in order to avoid that we will have to sanitize everytime the parameter. It could be done, but it is one more thing that we will need to take care for.

I think the proposed mixed approach will cover most of the cases - you'll have both a random and a human readable part that will be normalized only once.

[ganigeorgiev]

The mixed approach is implemented in master (will be available with the next v0.5.0 release).
The stored filename will be something like original_file_name_xpng9ihdjo.png.