Ckfinder Symfony2 Bundle Laravel Package

Getting Started

Coming from Laravel, treat this as the Symfony equivalent of a package that registers a route, a controller, and a config array: the bundle is a thin wrapper around the standalone CKFinder 3 PHP connector. The connector does the actual file browsing/uploading; the bundle wires it into Symfony's routing, DI, and authentication.

Minimal path:

1. Install the bundle and its connector dependency:

   composer require ckfinder/ckfinder-symfony2-bundle
   

2. Enable it in app/AppKernel.php:

   new CKSource\Bundle\CKFinderBundle\CKFinderBundle(),
   

3. Import the bundle routing in app/config/routing.yml and give it a prefix:

   ckfinder:
       resource: "@CKFinderBundle/Resources/config/routing.xml"
       prefix: /ckfinder
   

4. Add the minimal bundle config in app/config/config.yml:

   ckfinder:
       connector:
           authentication:
               check_authentication: true
   

5. Create an authentication service implementing the bundle's AuthenticationInterface and tag it ckfinder.authentication. The connector will call it on every request.
6. Supply the CKFinder 3 connector array itself — backends, resource types, privateDir, license. This is the part to verify against the exact tag you install; look at DependencyInjection/Configuration.php and the bundle README to see whether your version expects it under the ckfinder.connector node or in the connector's own config file. The connector array is where backends (e.g. local adapter with root and baseUrl) and resourceTypes (e.g. Files, Images with directory, maxSize, allowedExtensions) live.

Where to look first:

• The bundle README for the supported config shape and authentication example.
• DependencyInjection/Configuration.php to see exactly which keys the bundle accepts.
• Controller/CKFinderController.php to understand how the connector is bootstrapped and where config/auth are injected.
• The CKFinder 3 PHP connector docs for backend/resource-type semantics, because the bundle delegates most of that.

First real use case: point CKEditor 4 (or the CKFinder JS client) at the connector route, e.g. /ckfinder/connector, and verify with a direct request:

/ckfinder/connector?command=Init&type=Images

If that returns CKFinder JSON, routing and config are working. If it returns an HTML error page, you have a Symfony routing/security/DI problem rather than a CKFinder problem.

Implementation Patterns

Single connector endpoint, multiple entry points. The usual setup is one imported route used by both the standalone CKFinder UI and CKEditor's file browser. CKEditor 4's filebrowserBrowseUrl / filebrowserUploadUrl or the CKFinder JS connectorPath should all resolve to the same route. If you need different behavior per resource type, use the type query parameter that CKFinder already understands instead of creating parallel routes.

Authentication as a first-class service. Implement authenticate() against Symfony's security context (AuthorizationChecker, token storage, session attributes) and tag the service. Keep it cheap: it runs on Init, thumbnails, and every upload/download request. Return false rather than throwing for unauthenticated users; CKFinder will emit a proper connector error. This is also the cleanest place to enforce "only admins can use the file manager."

Per-user or per-tenant directories. Two common patterns:

• Configure a resource type directory per user/tenant, or switch the backend root dynamically using a CKFinder plugin/event listener that runs on connector init. The bundle exposes the connector as a service, so you can attach listeners from your own bundle.
• Keep a single uploads root and use CKFinder's ACL/event hooks to restrict folder visibility and write access. This avoids creating dozens of resource types.

For most admin-panel use cases, the second is simpler; for strict tenant isolation, the first is safer.

Backend selection. Local adapter is the default and the least surprising. If the CKFinder PHP connector version in use supports Flysystem adapters (S3, FTP, Dropbox), you can point a backend at object storage and let CKFinder handle listing and thumbnails. Keep baseUrl aligned with however the frontend serves those files — a CDN URL for S3, a /uploads path for local.

Uploads directory layout. In Symfony 2, root typically points under web/ (e.g. %kernel.root_dir%/../web/uploads) and baseUrl is the matching public path (/uploads). Keep privateDir (cache, thumbs, logs, tags) outside the public web root. Treat root as application data and privateDir as disposable state.

CKEditor integration. CKFinder 3 is designed for CKEditor 4-era integration. Configure the editor to use the connector route, and make sure the JS client version matches the connector major version. Don't mix a CKFinder 4/5 frontend with a CKFinder 3 connector; the command protocol and response shapes differ.

Custom plugins and events. CKFinder's event dispatcher is the extension point for image resizing, watermarking, filename sanitization, and per-request config changes. Register plugins in the connector config, or attach listeners to the connector service from Symfony. This is the equivalent of a Laravel middleware/event listener: do it outside vendor code so upgrades remain possible.

Environment config. Commit the connector array and use Symfony parameters for paths and license data. Symfony 2 uses %kernel.root_dir%; if you later move to Symfony 3.3+, that becomes %kernel.project_dir%. Avoid hard-coded absolute paths that differ between local, staging, and production.

Gotchas and Tips

License key is not optional in production. CKFinder 3 is commercial. Without a valid license it runs in demo mode, with watermarking and feature limitations. Put the license in parameters/env, not in a committed config file.

The connector route is a separate entry point. Symfony's firewall and access_control protect paths, not "the admin panel." If your firewall only matches /admin, /ckfinder/connector may be publicly reachable. Combine bundle authentication (check_authentication: true plus your service) with an explicit access_control rule for the connector prefix.

Authentication service wiring is tag-sensitive. If check_authentication is on but CKFinder always denies (or always allows), confirm the service is tagged ckfinder.authentication, is public where required by your Symfony version, and is actually the one the bundle resolves. In Symfony 2 services are public by default; in later versions this is a common failure point.

Mismatched root and baseUrl produces confusing behavior. Listing may work while thumbnails 404, or uploads may succeed but not display. Check that the PHP process can write to root, that baseUrl maps to the same directory through the web server, and that symlinks/open_basedir aren't hiding the real path.

PHP limits beat CKFinder limits. maxSize in a resource type does not override upload_max_filesize, post_max_size, or max_file_uploads. Large-file complaints usually come from PHP or the web server, not CKFinder.

privateDir must exist and be writable. Thumbnails require GD or Imagick; a missing privateDir or missing image extension often manifests as broken previews rather than a clear error.

Clear the Symfony cache after config changes. Symfony 2 container caching means changed bundle config or service tags may not take effect until php app/console cache:clear. In dev, watch app/logs/dev.log; in prod, app/logs/prod.log.

Distinguish connector errors from Symfony errors. CKFinder returns JSON with an error code for its own failures. An HTML page, a Symfony exception screen, or a redirect means the request never reached the connector: check routing, firewall, CSRF, and auth first. Temporarily disabling check_authentication is a quick way to isolate auth from config.

Don't wrap the connector in Symfony CSRF. CKFinder has its own request handling and token model. Applying Symfony's CSRF protection to the connector route usually breaks uploads rather than securing them.

Version and lifecycle risk. This bundle targets Symfony 2, which is long EOL; the package has low stars/dependents and limited community activity. Expect to read the source for exact config behavior. For new projects, prefer the current CKFinder bundle for supported Symfony versions, the standalone CKFinder PHP connector behind a route, or a maintained file-manager alternative. If you must keep it, pin the CKFinder PHP connector version alongside the bundle and test upgrades deliberately.

Debugging recipe. Hit ?command=Init&type=Images with curl, check the JSON, then check the Symfony log, then check privateDir/root permissions. This sequence separates protocol issues, framework issues, and filesystem issues faster than reading the frontend console.