- How do I install yangyifan/upload in a Laravel application?
- Install it with Composer using composer require yangyifan/upload, then register the package service provider if your Laravel version does not auto-discover it and publish the configuration file. The package follows Laravel's recommended extend approach, so it plugs into the framework's filesystem disk setup rather than replacing it. Check the README for the exact provider class and config publish command for your Laravel version.
- Which Laravel and PHP versions does this upload package support?
- The package targets Laravel 5.x era applications and is distributed as yangyifan/upload on Packagist. Because it has very few dependents and limited maintenance signals, verify the composer.json constraints against your PHP and Laravel version before adopting it. On Laravel 10 or 11 you will most likely need to fork it and adjust the service provider and dependency constraints.
- Does this package support multiple file uploads in one request?
- Yes, it is designed for both single and multiple file uploads inside a Laravel application. You pass the uploaded files through the package's handling layer, which applies validation and then pushes each file to the configured storage disk. For multiple uploads you typically iterate over the request files or hand an array to the upload handler.
- How do I configure Qiniu, Upyun, Aliyun OSS or Tencent COS with this package?
- Configuration lives in the package's published config file, where you register credentials, bucket names and region settings for Qiniu, Upyun, Aliyun OSS and Tencent COS. Each provider is implemented as an extension of Laravel's filesystem layer, so disks are registered the same way as native disks. Keep credentials server-side in your .env file and never expose secrets to the browser.
- How does validation work for uploaded files in yangyifan/upload?
- Validation runs before the file reaches storage, and you can layer Laravel's own rules such as mimes, max and image on top of the package's handling. Because MIME sniffing and extension checks are security-critical, confirm in the source how the package verifies file types instead of trusting the client-supplied extension. Add your own allowlist rules in a form request for defense in depth.
- How is yangyifan/upload different from Laravel's native Storage facade?
- Laravel's native Storage facade with Flysystem already covers local disks and S3-compatible targets. This package earns its place mainly through adapters for Chinese cloud providers such as Qiniu, Upyun, Aliyun OSS and Tencent COS. If you only need local or S3 storage, staying on native Storage is the lower-risk choice.
- How should I test file uploads that use this package?
- Wrap the package behind your own upload service interface so tests can fake that interface instead of hitting a real cloud bucket. In feature tests use UploadedFile::fake() and Storage::fake() for local disks, and assert the resulting paths plus validation failures. There is little evidence of an extensive upstream test suite, so treat your own contract tests as the safety net.
- Is this package safe for production file uploads?
- File upload is a security-sensitive boundary, so review how the package sanitizes filenames, verifies MIME types and cleans up temporary or chunked files. Make sure path traversal, decompression bombs and disk exhaustion are handled, and keep all cloud credentials server-side. Because the code has very little external production evidence, run a targeted security review before going live.
- Is the documentation in English, and is the package actively maintained?
- The README and documentation are primarily in Chinese, so budget time for translation or internal notes. The project is maintained by an individual with a small dependent base, which means you should check the last commit date and open-issue responsiveness. Expect to vendor or fork the package under your own organization if upstream activity stalls.
- Can I set custom file names and storage paths with this package?
- Yes, you can control the destination disk, directory and filename when handing a file to the package, which helps organize avatars, attachments and images per tenant or date. Combine that with validation rules and your own naming convention to avoid collisions and unsafe extensions. Confirm the exact method signatures in the README, since they follow the package's own conventions.