Merge branch '4.x' into 5.x

Author: danharrin

docs/09-advanced/06-security.md

@@ -200,13 +200,13 @@ The value of a `FileUpload` field is a string (or array of strings) pointing to
 
 Filament allows this by default because legitimate features depend on it — for example, an action that sets a field to a pre-uploaded template file, or a "copy from another record" button. If your forms do not rely on such a flow, opt in to the built-in checks:
 
-- For `FileUpload` fields, call [`preventFilePathTampering()`](../forms/file-upload#authorizing-existing-file-paths) to drop submitted paths that do not match the original value on the record.
-- For `RichEditor` fields, call [`preventFileAttachmentPathTampering()`](../forms/rich-editor#securing-file-attachment-ids) to strip `data-id` values that are not already present in the record's stored content.
+- For `FileUpload` fields, call [`preventFilePathTampering()`](../forms/file-upload#authorizing-existing-file-paths) to fail validation when a submitted path does not match the original value on the record.
+- For `RichEditor` fields, call [`preventFileAttachmentPathTampering()`](../forms/rich-editor#securing-file-attachment-ids) to fail validation when a submitted `data-id` is not already present in the record's stored content.
 
 Both methods compare submitted values against the attribute on the record via `$record->getOriginal()`, and both accept an `allowFilePathUsing` callback for paths that are legitimately added outside the record (such as shared template files). Newly uploaded files and images always pass through unchanged.
 
 <Aside variant="warning">
-    These checks require a record on the form, so on create pages every submitted existing path is rejected unless the `allowFilePathUsing` callback approves it. New uploads are unaffected.
+    These checks require a record on the form, so on create pages every submitted existing path fails validation unless the `allowFilePathUsing` callback approves it. New uploads are unaffected.
 </Aside>
 
 If you want these checks to apply across your entire application rather than remembering to add them to each field, enable them globally from a service provider's `boot()` method using `configureUsing()`:

packages/actions/src/Exports/Jobs/CreateXlsxFile.php

@@ -26,6 +26,13 @@ class CreateXlsxFile implements ShouldQueue
 
     public bool $deleteWhenMissingModels = true;
 
+    public ?int $tries = 3;
+
+    public ?int $maxExceptions = 0;
+
+    /** @var array<int> */
+    public array $backoff = [30, 60, 300];
+
     protected Exporter $exporter;
 
     /**

packages/actions/src/Exports/Jobs/ExportCompletion.php

@@ -23,6 +23,10 @@ class ExportCompletion implements ShouldQueue
 
     public bool $deleteWhenMissingModels = true;
 
+    public ?int $tries = 1;
+
+    public ?int $maxExceptions = 0;
+
     protected Exporter $exporter;
 
     /**

packages/actions/src/Exports/Jobs/ExportCsv.php

@@ -63,6 +63,10 @@ public function middleware(): array
 
     public function handle(): void
     {
+        if ($this->batch()?->cancelled()) {
+            return;
+        }
+
         /** @var Authenticatable $user */
         $user = $this->export->user;
 

packages/actions/src/Exports/Jobs/PrepareCsvExport.php

@@ -29,6 +29,10 @@ class PrepareCsvExport implements ShouldQueue
 
     public bool $deleteWhenMissingModels = true;
 
+    public ?int $tries = 1;
+
+    public ?int $maxExceptions = 0;
+
     protected Exporter $exporter;
 
     /**
@@ -52,6 +56,10 @@ public function __construct(
 
     public function handle(): void
     {
+        if ($this->batch()?->cancelled()) {
+            return;
+        }
+
         $csv = Writer::from(new SplTempFileObject);
         $csv->setOutputBOM(Bom::Utf8);
         $csv->setDelimiter($this->exporter::getCsvDelimiter());

packages/actions/src/Imports/Jobs/ImportCsv.php

@@ -64,6 +64,10 @@ public function middleware(): array
 
     public function handle(): void
     {
+        if ($this->batch()?->cancelled()) {
+            return;
+        }
+
         /** @var Authenticatable $user */
         $user = $this->import->user;
 

packages/forms/docs/09-file-upload.md

@@ -196,10 +196,10 @@ FileUpload::make('avatar')
     ->preventFilePathTampering()
 ```
 
-Filament compares every submitted string path against the value originally loaded from the record (via `$record->getOriginal()` for the attribute matching the field name). Paths that do not match are dropped before the record is saved and before any URL is generated for the field. Newly uploaded files always pass through, the field can still be cleared, and for `multiple()` fields each entry is checked individually.
+Filament compares every submitted string path against the value originally loaded from the record (via `$record->getOriginal()` for the attribute matching the field name). Paths that do not match cause the field to fail validation, so the record is never saved with a tampered value. Newly uploaded files always pass through, the field can still be cleared, and for `multiple()` fields each entry is checked individually.
 
 <Aside variant="warning">
-    `preventFilePathTampering()` needs a record on the form. Without one — for example, on a create page — every submitted string path is rejected unless the [`allowFilePathUsing`](#allowing-additional-file-paths-with-a-callback) callback approves it. New uploads are unaffected.
+    `preventFilePathTampering()` needs a record on the form. Without one — for example, on a create page — every submitted string path fails validation unless the [`allowFilePathUsing`](#allowing-additional-file-paths-with-a-callback) callback approves it. New uploads are unaffected.
 </Aside>
 
 To apply this check to every `FileUpload` in your application without repeating it on each field, call `configureUsing()` in a service provider's `boot()` method:
@@ -216,7 +216,7 @@ Individual fields can still opt out by calling `preventFilePathTampering(false)`
 
 ### Allowing additional file paths with a callback
 
-If your application legitimately references a path that is not on the record — for example, a button that selects a pre-uploaded template file — pass the `allowFilePathUsing` argument to approve it:
+If your application legitimately references a path that is not on the record — for example, a button that selects a pre-uploaded template file — pass the `allowFilePathUsing` argument to approve it. Approved paths bypass the validation error:
 
 ```php
 use Filament\Forms\Components\FileUpload;
@@ -229,6 +229,18 @@ FileUpload::make('avatar')
 
 <UtilityInjection set="formFields" version="5.x" extras="File;;string;;$file;;The submitted file path being authorized.">You can inject various utilities into the function passed to `allowFilePathUsing` as parameters.</UtilityInjection>
 
+The validation error message can be customized via [`validationMessages()`](validation#customizing-validation-messages) using the `tampered` key:
+
+```php
+use Filament\Forms\Components\FileUpload;
+
+FileUpload::make('avatar')
+    ->preventFilePathTampering()
+    ->validationMessages([
+        'tampered' => 'The selected attachment is not permitted.',
+    ])
+```
+
 ## Avatar mode
 
 You can enable avatar mode for your file upload field using the `avatar()` method:

packages/forms/docs/10-rich-editor.md

@@ -412,12 +412,12 @@ RichEditor::make('content')
     ->preventFileAttachmentPathTampering()
 ```
 
-Filament parses the record's original content (via `$record->getOriginal()` for the attribute matching the field name) and allows only the `data-id` values already present. Any other existing `data-id` has its `id` and `src` attributes removed before the record is saved and before any URL is generated. Newly uploaded images always pass through.
+Filament parses the record's original content (via `$record->getOriginal()` for the attribute matching the field name) and allows only the `data-id` values already present. Any other existing `data-id` causes the field to fail validation, so the record is never saved with a tampered value. Newly uploaded images always pass through.
 
 If you are using the [`spatie/laravel-medialibrary` plugin](https://filamentphp.com/plugins/filament-spatie-media-library#using-media-library-for-rich-editor-file-attachments) as the file attachment provider, this protection is already implicit — it looks up each `data-id` against the record's own media collection.
 
 <Aside variant="warning">
-    `preventFileAttachmentPathTampering()` needs a record on the form. Without one — for example, on a create page — every existing `data-id` is rejected unless the [`allowFilePathUsing`](#allowing-additional-data-id-values-with-a-callback) callback approves it. New uploads are unaffected.
+    `preventFileAttachmentPathTampering()` needs a record on the form. Without one — for example, on a create page — every existing `data-id` fails validation unless the [`allowFilePathUsing`](#allowing-additional-data-id-values-with-a-callback) callback approves it. New uploads are unaffected.
 </Aside>
 
 To apply this check to every `RichEditor` in your application without repeating it on each field, call `configureUsing()` in a service provider's `boot()` method:
@@ -434,7 +434,7 @@ Individual fields can still opt out by calling `preventFileAttachmentPathTamperi
 
 #### Allowing additional `data-id` values with a callback
 
-If your application legitimately references an identifier that is not on the record — for example, a "copy from another record" action — pass the `allowFilePathUsing` argument to approve it:
+If your application legitimately references an identifier that is not on the record — for example, a "copy from another record" action — pass the `allowFilePathUsing` argument to approve it. Approved identifiers bypass the validation error:
 
 ```php
 use Filament\Forms\Components\RichEditor;
@@ -447,6 +447,18 @@ RichEditor::make('content')
 
 <UtilityInjection set="formFields" version="5.x" extras="File;;string;;$file;;The submitted `data-id` value being authorized.">You can inject various utilities into the function passed to `allowFilePathUsing` as parameters.</UtilityInjection>
 
+The validation error message can be customized via [`validationMessages()`](validation#customizing-validation-messages) using the `tampered` key:
+
+```php
+use Filament\Forms\Components\RichEditor;
+
+RichEditor::make('content')
+    ->preventFileAttachmentPathTampering()
+    ->validationMessages([
+        'tampered' => 'The content references an image that is not permitted.',
+    ])
+```
+
 ### Validating uploaded images
 
 You may use the `fileAttachmentsAcceptedFileTypes()` method to control a list of accepted mime types for uploaded images. By default, `image/png`, `image/jpeg`, `image/gif`, and `image/webp` are accepted:

packages/forms/resources/lang/en/validation.php

@@ -7,4 +7,6 @@
         'only_one_must_be_selected' => 'Only one :attribute field must be selected.',
     ],
 
+    'tampered_file_path' => 'The :attribute field contains a file path that is not permitted.',
+
 ];

packages/forms/src/Components/BaseFileUpload.php

@@ -692,6 +692,30 @@ public function getValidationRules(): array
             ...$arrayRules,
         ];
 
+        if ($this->shouldPreventFilePathTampering()) {
+            $rules[] = function (string $attribute, mixed $value, Closure $fail): void {
+                $originalPaths = $this->getOriginalFilePaths();
+
+                foreach (Arr::wrap($value) as $file) {
+                    if ($file instanceof TemporaryUploadedFile) {
+                        continue;
+                    }
+
+                    if (! is_string($file)) {
+                        continue;
+                    }
+
+                    if ($this->isFilePathAuthorized($file, $originalPaths)) {
+                        continue;
+                    }
+
+                    $fail(__($this->getValidationMessages()['tampered'] ?? 'filament-forms::validation.tampered_file_path', ['attribute' => $this->getValidationAttribute()]));
+
+                    return;
+                }
+            };
+        }
+
         $rules[] = function (string $attribute, array $value, Closure $fail) use ($fileRules): void {
             $files = array_filter($value, fn (TemporaryUploadedFile | string $file): bool => $file instanceof TemporaryUploadedFile);
 
@@ -915,10 +939,6 @@ public function saveUploadedFiles(): void
             return;
         }
 
-        if ($this->shouldPreventFilePathTampering()) {
-            $this->dropTamperedFilePaths();
-        }
-
         $rawState = array_filter(array_map(function (TemporaryUploadedFile | string $file) {
             // String values represent paths to files that already exist on the disk, and
             // are passed through unchanged. Like any Livewire form field value, this
@@ -963,27 +983,6 @@ public function saveUploadedFiles(): void
         $this->callAfterStateUpdated();
     }
 
-    protected function dropTamperedFilePaths(): void
-    {
-        $originalPaths = $this->getOriginalFilePaths();
-
-        $filtered = [];
-
-        foreach (Arr::wrap($this->getRawState()) as $key => $file) {
-            if ($file instanceof TemporaryUploadedFile) {
-                $filtered[$key] = $file;
-
-                continue;
-            }
-
-            if (is_string($file) && $this->isFilePathAuthorized($file, $originalPaths)) {
-                $filtered[$key] = $file;
-            }
-        }
-
-        $this->rawState($filtered);
-    }
-
     /**
      * @param  array<string> | null  $originalPaths
      */