Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

danialm's avatar

hello I wrote an uploader and downloader using Laravel like this: Upload:

hello I wrote an uploader and downloader using Laravel like this: Upload:

public function __invoke(UploadRequest $request, StoreFileAction $storeFileAction) { if ($request->hasFile('file')) { $file = $request->file('file');

        $name = time() . '_' . uniqid() . '.' . $file->extension();

        $path = $file->storeAs('user-data', $name, 'public');

        $stored = $storeFileAction->execute($path);
        return Response::success('File uploaded successfully', ['dl' => route('download', ['data' => $stored->slug])], code: 201);
    }
    return Response::error('Please try again');
}

Download:

public function __invoke(Data $data) { return response()->download('storage/' . $data->path); }

Validation for file upload:

class UploadRequest extends FormRequest { public function rules(): array { return [ 'file' => ['required', 'file', 'max:1000'] ]; } }

Is this code optimal? What should be changed to be more optimal and safe from malicious users? Thank you for your advice

0 likes
2 replies
jlrdw's avatar

How are you getting $file->extension()?

Also, if user is looking for (example only) baby_first_steps.jpg

How do they find it.?

Also I suggest viewing:

https://symfonycasts.com/screencast/symfony-uploads/file-naming#play

https://symfonycasts.com/screencast/symfony-uploads/upload-in-form#play

Basically the vulnerability isn't in the name, it's in the extension.

I normally name like this, say original is ann.jpg.

ann_number of images + 1_userid

so ann_1079_127.jpg

But so far your code looks pretty good.

Snapey's avatar

Please format your codeblocks for this site.

Please show your StoreFileAction

Why do you need a download function when your files are in public disk?

So a user can upload their own php files?

Your validation will prevent the controller being called with no file, so the test and error message is irrelevant

Please or to participate in this conversation.