The File type lets the visitor attach a document: a plan, a photo, a CV. A file from strangers is handled with care, and Formulus does it without asking you for more than two settings.
The field's settings
Behind the cog, All settings of this field, General tab:
| Setting | What it does |
|---|---|
| Accepted formats | The allowed extensions, separated by commas. Default: pdf, jpg, jpeg, png. |
| Maximum size (MB) | Beyond it, the file is refused. The server's limit wins if it is lower. |
| Attach to the notification | The file also goes as an attachment to the mail sent to the team. |
Under the field, on the site, an instruction tells the visitor the formats and size before they send: "Accepted formats: PDF, JPG, JPEG, PNG. Maximum size: 2 MB."
What is checked
In this order, and each refusal is explained to the visitor under the field:
- that the upload actually happened;
- the size;
- the extension, among the field's and those Formulus knows how to check: pdf, jpg, jpeg, png, gif, webp, txt, csv, odt, ods, doc, docx, xls, xlsx, zip. No
.html,.svgor.php, even if asked for; - the file's real content: a
.pdfthat is not a PDF is refused; - Joomla's own safety check: hidden code tags, double extensions.
Where files go
Into administrator/components/com_formulus/depots, under a random name, without an extension, in a folder closed to any direct access (.htaccess for Apache, web.config for IIS). The original name is kept only in the response. A file only opens through the administration, once logged in.
You can choose another folder, preferably outside the site: Formulus → Options, Files tab, an absolute path on the server. On nginx, which does not read those protection files, add a rule that forbids the folder, or put it outside the site root.
An error does not lose the file
If the form is refused for another reason (a forgotten field), the file already received is kept: the visitor reads "plan.pdf (1.2 MB) has been received: no need to choose it again". Browsers always forget the chosen file when the page comes back; without this, the visitor would have to find it again after every error.
Viewing a file
In the response, the file name is a link. A PDF or an image opens in a new tab; other formats download. The notification mail carries the same link.
When files are deleted
- with the response, when you delete it;
- by the scheduled task, when the response is older than the retention period;
- by a GDPR erasure request;
- right after the mail is sent, if the form does not store responses: the mail was then the only trace;
- a file left without a response (an abandoned submission) is removed by the scheduled task after two days.
Up to date for Formulus 1.0.237.