- How do I install jonlil/ckfinder in a Laravel application?
- Run composer require jonlil/ckfinder, then publish the package configuration with php artisan vendor:publish and review config/ckfinder.php. On Laravel 5.5 and later the service provider and facade are auto-discovered, so no manual registration is needed. Installation is quick — roughly half a day — but the real work is licensing, route guarding, and storage decisions.
- Which Laravel and PHP versions does jonlil/ckfinder support?
- Do not assume modern versions work: the package shows no visible Laravel version tracking, so treat the supported matrix as unknown until you check. Read the Composer constraints in composer.json and confirm whether auto-discovery applies to your Laravel release. Also verify PHP 8.x, CKFinder 3, and CKEditor compatibility in a short spike before committing.
- Do I need a commercial CKFinder license to use this package?
- Yes. CKFinder is commercial software from CKSource, and this package is only a thin Laravel wrapper around its connector. You need a valid CKFinder 3 license covering your seat count, and you must confirm the terms allow your deployment and any redistribution. The wrapper itself grants no rights to CKFinder.
- Is the CKFinder connector route protected by authentication by default?
- Do not assume so. The package exposes a connector route, and access control is your responsibility: register the route behind authenticated and admin middleware and add gates or policies on top. Treat it as an untrusted upload endpoint and verify in a sandbox that anonymous requests are actually rejected.
- Is jonlil/ckfinder actively maintained and safe for production uploads?
- The package has no visible community traction, so there is no issue triage, no security patching, and no Laravel version tracking. For a route that accepts untrusted uploads, that means adopting unsupported code. The footprint is small, so read src/, pin an exact version, and be prepared to own roughly a couple hundred lines yourself.
- How do I configure where uploaded files are stored in Laravel?
- After publishing config/ckfinder.php, set the connector's baseUrl and baseDir and map media onto a dedicated Laravel filesystem disk instead of the application root. Keep public and private files separated and default to private with no anonymous browsing. Restrict allowed extensions and maximum size in the config and validate MIME types on upload.
- Can I use this package with CKEditor's Browse Server image picker?
- Yes. The primary use case is a server-rendered admin or CMS surface where authors use CKEditor's Browse Server button to insert images and documents. It is not a JSON API for custom React or Vue pickers. If your frontend is a SPA, plan a different upload flow instead.
- How should I test the CKFinder integration before going live?
- Run a time-boxed spike in an isolated branch with an exact version pin, and publish and review the config before anything else. Test anonymous access, path traversal attempts, disallowed file types, and tenant boundaries, and confirm compatibility with your Laravel, PHP, CKFinder, and CKEditor versions. Keep the integration behind a feature flag until the review passes.
- What are good alternatives to jonlil/ckfinder for Laravel file uploads?
- If CKFinder is not an explicit product requirement, consider spatie/laravel-medialibrary for API-first media handling, UniSharp/laravel-filemanager for a free browser UI, or S3 presigned uploads with a bespoke picker. If CKFinder is mandatory, CKSource's own Laravel integration or wiring the official connector behind Laravel middleware gives you a supported upgrade path.
- How difficult is it to remove or replace jonlil/ckfinder later?
- Because the integration is essentially one service provider plus one config file, the exit plan is cheap. Keep it behind an adapter interface so domain code never references the package directly, and you can swap in direct CKFinder wiring or a native upload service quickly. Decide the removal path before adopting it, not after.