flow-development-collection: PersistentResource gets persisted if a attached validation fails

Description

If a model has a PersistentResource as a property and a custom validator attached, validating ex. the Media Type (allow only jpg and png) the PersistentResource is persisted and stored even though the validation fails.

Steps to Reproduce

  1. Create a model with a PersistentResource as property
  2. Create a validator that returns false
  3. Submit a form with a resource
  4. See in the log
16-12-09 11:35:14 67587      DEBUG     Flow                 Successfully imported the uploaded file "8196730941.webm" into the resource collection "persistent" (storage: "defaultPersistentResourcesStorage", a Neos\Flow\ResourceManagement\Storage\WritableFileSystemStorage. SHA1: f3fa2e994fb478dfc9eac52c5addc51de1f7fb38)
16-12-09 11:35:14 67587      ERROR     Flow                 Validation failed while trying to call Application\RestApi\Controller\ImageController->uploadAction().
Error for data:  The media type "video/webm" is not allowed for this image.

16-12-09 11:35:14 67587      DEBUG     Flow                 FileSystemSymlinkTarget: Published file. (target: localWebDirectoryPersistentResourcesTarget, file: f3fa2e994fb478dfc9eac52c5addc51de1f7fb38/8196730941.webm)

Expected behavior

As the validation of the property returns false, the whole object is considered “invalid” and therefore the resource should not be persisted.

As the import is managed inside the ResourceTypeConverter and it’s applied before the validation, the resource is already persisted at that point.

It could be argumented that the validator could clean up, but that’s not the task for a validator that only returns true/false.

Somehow a way to interact with the ResourceTypeConverter and be able to have validator(s) validate the input

Actual behavior

The resource is persisted

Affected Versions

Neos: *

Flow: *

About this issue

  • Original URL
  • State: open
  • Created 8 years ago
  • Comments: 15 (15 by maintainers)

Most upvoted comments

@kdambekalns @robertlemke this is a rather problematic behaviour (anyone can spam the server with files) and very core - is this something we should tackle maybe for 4.1 in an effort?

I think I have found a good approach now on how to tackle this finally.