Symfony Dropzone Laravel Package

A maintenance release: one dependency that was never declared, the mode nobody had ever run, and three documentation problems found by following the docs literally.

No security change. The 2.1.0 fix is untouched, and nothing here is a regression from it.

Fixed

symfony/doctrine-bridge is now a declared dependency. The bundle builds a Symfony\Bridge\Doctrine\Form\Type\EntityType whenever multiple is false, and that class ships with the bridge, which appeared in neither require nor require-dev. It worked only because doctrine/doctrine-bundle pulls the bridge in transitively. Installed without it, that one option was a fatal error.

Tested

The single-file mode had no test at all, for the same reason: EntityType resolves its choices through a ManagerRegistry, which a mock cannot stand in for. The suite now builds a real in-memory SQLite stack, so the path runs for real and gets the same hostile-filename checks as the multiple mode. It was also exercised in a browser for the first time.

Documentation

• A minimal end to end example now sits ahead of the quick start, which went from installation straight into two hundred lines.
• File entities must implement __toString(). The widget renders the entity itself into the hidden field, so the entity example as documented crashed any edit form holding existing files. If your entity is not stringable, add it.
• The file removal flow is corrected. It claimed the removed id is left out of the next submission. It is not: files already attached when the page was rendered are also listed in hidden fields written by Symfony, which the widget never removes, so their ids keep being submitted after the preview disappears. This is long-standing behaviour, identical in 2.0.0. It is harmless when your remove handler really deletes the file, and it will re-link the file if your handler only unlinks it.
• Sending an extra field with each upload is documented, through symfony-dropzone:sending. That is the case behind the formDataRaw proposal in #2, and the events section never showed it.

All three translations updated.

Upgrading

composer update ethsam/symfony-dropzone. No configuration change, no behaviour change. Check that your file entity implements __toString(), and re-read your remove handler against the corrected removal flow above.

Full changelog: https://github.com/ethsam/symfony-dropzone/compare/v2.1.0...v2.1.1

Security release. Upgrading is recommended for every project using 2.0.0 or earlier.

composer require ethsam/symfony-dropzone:^2.1

Security

The widget used to build its inline JavaScript by interpolating application data into it, including the filename of every already attached file:

name: '{{ file.filename }}',

Twig's automatic escaping is HTML escaping, which is the wrong defence inside a <script>: entities are never decoded there, and a filename ending in a backslash cancels the closing quote so the string runs on into the surrounding code. file.size was interpolated outside of any quotes at all.

Filenames come from whoever uploads a file. The minimum consequence is that the script fails to parse, leaving the upload field unusable for anyone opening that record. With control over several filenames the quotes can be realigned, which turns it into stored cross site scripting in the session of whoever opens the form. Every version up to 2.0.0 is affected, as is the original emr-dev/symfony-dropzone this bundle forks.

Everything the browser needs now travels as JSON inside an HTML attribute and is read back with JSON.parse. The inline script is a constant: identical byte for byte whatever the database holds. tests/Form/DropzoneWidgetRenderTest.php renders the widget with hostile stored values and fails if any of them reaches the script.

If you keep a copy of dropzone.html.twig under templates/bundles/SymfonyDropzoneBundle/, that copy overrides the bundle and stays vulnerable after upgrading. Delete it or port your changes.

See SECURITY.md.

Added

• maxFilesize option, mapping to Dropzone.js maxFilesize in MiB. Thanks to @nicodemuz for the proposal in #3.
• symfony-dropzone:init, symfony-dropzone:sending and symfony-dropzone:removedfile DOM events, so applications can extend the widget without overriding the template. This covers the use case behind #2, appending a browser computed value to the upload, without injecting JavaScript from PHP. The prefix avoids a collision with Dropzone.js 6's own dropzone:* events.
• SECURITY.md with a reporting channel and the rendering rule the bundle follows.
• Continuous integration on PHP 8.1 to 8.4 against Symfony 5.4, 6.4 and 7, plus a dependency audit. Third party actions are pinned to a commit SHA.

Changed

• Options are type checked with setAllowedTypes. A value of the wrong type now raises an exception at form build time instead of being serialised into the page. '5' instead of 5 for maxFiles used to be coerced and now fails.
• Filenames containing ', &, < or > are displayed correctly. They used to show as HTML entities, for instance O'Brien.pdf.
• The file id is URL encoded in the remove request, and the hidden input lookup no longer builds a CSS selector out of it.
• The widget renders one extra element, <span hidden data-dropzone-config>, next to the form field.

No option was renamed or removed, and no application code has to change.

Full changelog: https://github.com/ethsam/symfony-dropzone/compare/v2.0.0...v2.1.0

Complete bundle refactor for production distribution.

Installable via Composer: composer require ethsam/symfony-dropzone:^2.0

Changed

• BREAKING: Minimum PHP version is now 8.1
• BREAKING: Minimum Symfony version is now 5.4 (5.4 / 6.x / 7.x supported)
• BREAKING: Removed jQuery dependency — the template uses vanilla JavaScript only
• BREAKING: Removed hardcoded DOM references (#add_property_arrayIdMedia)
• Proper transform() implementation in DropzoneTransformer
• Complete composer.json with all required dependencies and metadata
• Typed properties, return types and declare(strict_types=1) throughout
• Bundle type changed from library to symfony-bundle

Added

• Bundle configuration tree with default options
• setRequired for the class, uploadHandler and removeHandler options
• Dropzone.autoDiscover = false to prevent conflicts with other instances
• PHPUnit test suite (11 tests, 46 assertions)
• Documentation in English, French and Spanish (docs/)
• .gitattributes for clean Composer installs, plus CHANGELOG.md and CONTRIBUTING.md
• Original author attribution in LICENSE

Fixed

• use App\Entity\File removed from the transformer (broke in non-App namespaces)
• Undeclared $options property in the transformer (PHP 8.2 deprecation)
• Boolean values in the Twig template now render correctly (true/false instead of 1/0)
• Wrong namespace in dropzone.php service config

Removed

• jQuery dependency
• Hardcoded #add_property_arrayIdMedia references

Full changelog: https://github.com/ethsam/symfony-dropzone/compare/v1.0.0...v2.0.0

Full Changelog: https://github.com/ethsam/symfony-dropzone/commits/v1.0.0