You are viewing limited content. For full access, please sign in.

Question

Question

LF Form file upload to server even without submit the form

Forms Laserfiche Security
Updated February 17, 2022
asked on October 16, 2020

Hi I notice that when using LF Form's "File Upload" control and when open such form and do a "upload", the files are immediately save to LF Form server (or external volume if you set it to). The problem is people can then close the Form without submit but those uploaded files still sits in LF Form server (DB or volume). 

I am wondering how LF Form handling those files? Anyone notice or know?

 

 

0 0

Answer

SELECTED ANSWER
replied on October 21, 2020 • Show version history

For files stored in file system, there is no easy way to clean up such file currently, it will be supported when we implement the feature to clean up such file with Data Maintenance(either for files in database and for files in file system). This feature is already in our backlog.

1 0

Replies

replied on October 16, 2020

I didn't realize this but I guess that makes sense, that is how all websites work I am pretty sure. The browser must successfully upload the file to the server, before you can submit the form.

They are likely cleaned up with other files in the database based on your retention settings.

0 0
replied on October 16, 2020

Hi Chad, actually I am able to browsing LF Form database and try to figure out relationship between Form submission vs file attachment.  It looks like when you start a form process you got a instance record, and when you upload files during the process they were associated with that instance. However the only difference that someone didn't submit the form (just start it) then there is no form data back to LF Form database. 

I think the potential risk of this kind of un-attended forms process are those have public facing Form with file upload in it, that some "evil" attackers can just open the form (with a bot or like) and feed in garbage files (virus or like) without submit so those forms process (instance) are in-complete.

 

I would like to see if Laserfiche can give out some guideline/suggestion when we need develop such kind of forms and any tool/settings allow un-attended forms process to automatically clean up those things.

 

regarding the retention settings, I will take a look. (never pay attention to this settings before).

 

0 0
replied on October 19, 2020 • Show version history

The file uploads will be saved to the Forms database before submit the form in order to display the uploaded files on the form. If you close the form without submitting it, the files will become unreferenced by any form submissions/drafts and there won't be any instance generated for such file upload(Instance will only be generated with form submission)

Currently the data maintenance won't clean up such files and we have a backlog item to support that. You can run "delete from [dbo].[cf_bp_attachment_data] where attachment_id not in (select [attachment_id] from [cf_bp_data_attachment_mapping])"(make sure only to execute this only when there is no user filling forms as it will delete files for the users that are currently filling the form and not submit yet) on the Forms database directly to clean up such data.

 

0 0
replied on October 19, 2020

Can we include these files in the retention plan? I would like an option to automatically remove old BLOB data on a schedule to keep the database from becoming a file system.

Anything that needs to be saved long term can be archived to the repository where it is saved as a classic disk file.

0 0
replied on October 19, 2020

Thanks Xiang for the clarification. The script will help clean files save to Database (Blob). However in latest version LF Forms, there is choice of saving uploads to file system. Is there a way to clean up those files from this situation?  

0 0
SELECTED ANSWER
replied on October 21, 2020 • Show version history

For files stored in file system, there is no easy way to clean up such file currently, it will be supported when we implement the feature to clean up such file with Data Maintenance(either for files in database and for files in file system). This feature is already in our backlog.

1 0
replied on February 17, 2022 • Show version history

We have added the support to auto clean up the files uploaded without submit the form(we called it as "unreferenced files" in Forms 11 Update 2(https://support.laserfiche.com/kb/1014352/list-of-changes-for-laserfiche-forms-11-update-2), it will auto clean up the files saved to database or file system.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...