UploadedFile::store() uses md5_file() to generate a file name

[jeroennoten]

A great new addition to Laravel 5.3 is the UploadedFile::store(), which also generates a filename. The generated filename is the MD5 hash of the contents of the file. So if the same file is uploaded twice, it will overwrite the first one (correct me if I'm wrong). This could be seen as a feature (it saves storage), but I think it is not the right thing to do (imagine modifying the file without changing the name). I would propose something like uniqid() to generate the filename.

[alexbowers]

It appears that the function is md5_file which is a php function to get an md5 hash of a file by filename, but not of the filename.

So i think this might be alright

[JosephSilber]

I agree that an md5 hash is not the best solution. What if you upload the same file to two records, and then delete one of the records? Presumably you'd have some sort of trigger that also deletes the file. Now the other record will be linking to a non-existent file 😕

[jeroennoten]

@alexbowers No... it returns the hash of the file contents. I think you're reading it wrong.

"Calculates the MD5 hash of the file specified by the filename parameter" (from http://php.net/manual/en/function.md5-file.php)

So it means that the file is specified by the filename parameter, not that it calculates the MD5 hash of the filename.

[alexbowers]

Ah, i misunderstood your question at the top.

[alexbowers]

@JosephSilber I guess that your code will have to check in the trigger function for if there is another reference to the file. If there isn't, then remove the file.

[JosephSilber]

Of course there are workarounds. I'm just saying its unexpected.

[Skysplit]

I think using tempnam() could solve this problem

[jeroennoten]

@Skysplit no that will not work on cloud storage disks like S3

[Skysplit]

@jeroennoten Ah, you're right. I forgot that there could be different storage drivers.

What about appending Illuminate\Support\Str::random() result to file name?

[jeroennoten]

That will not generate a unique name. Better use something like uniqid().

[franzliedke]

IIRC MD5 also has problems with conflicts that can be generated by appending well-crafted bytes to a known file. I guess that could be abused to overwrite an existing file with a malicious version.. M

[boynet]

I have multiple projects that involve content uploads to cloud , in the end there is no way to generate unique name without actually checking for existence first(from the file system or db).

uniqid is good base but it's not 100% guarantee to uniqueness

[jeroennoten]

@boynet You're completely right.

[LonnyX]

With this way, we should never remove the files from the disks because their are linked with more than once.

GUID seems a approach, no?