"FileField" validation does not account for "upload_to" when counting characters

[Denilson Figueiredo de Sá]

I have a model with a FileField object:

def set_file (instance, filename):
    return os.path.join("uploaded_files/my_obj_%d" % instance.my_obj_id, os.path.basename(filename))

class MyModel(models.Model):
    my_file = models.FileField(upload_to=set_file, null=True)

And I have a view that receives the POST and handles it to a trivial forms.ModelForm object. In that view I check for .is_valid().

Since the FileField creates a 100-char column at the database, any filename greater than 100 chars will be rejected, and the form instance will have a nice error message talking about this.

However, this comparison is broken, because the actual data stored at the database won't be the filename, but instead the return value of the "upload_to" callable. This returned value, in my case, has more characters than the actual filename.

Thus, in this case, filenames between 75 and 100 characters will be accepted by the form validation, but will be rejected by the database when the actual .save() occurs.

I'm not very sure about what is the best solution, but the forms.fields.FileField shouldn't rely just on the max_length parameter when validating the input.

[Łukasz Rekucki]

I just go bitten by this. I'm not sure about how to fix this properly. Checking it at forms.FileField works as long as you are using ModelForms. IMHO, the FileField itself should reject names that exceed max_length after being processed by upload_to.

Maybe we should also pass max_length as an argument to upload_to, so the user could handle this (with hashing for example). Either way, a custom exception would be much better than leaving it to the DB layer which yields a DatabaseError (and it would show up on sqlite, so people can catch this earlier).

[Claude Paroz]

Duplicate of #9893.

[Walter Doekes]

I've taken the liberty to re-open this, as #9893 never did address this. See:
https://code.djangoproject.com/ticket/9893#comment:46
https://code.djangoproject.com/ticket/9893#comment:36

[Denilson Figueiredo de Sá]

Just an idea… Are we ever going to query the database for the filename? If not, we could store it as TEXT instead of VARCHAR.

[Tim Graham]

Changing the datatype to TEXT is likely unacceptable due to backwards compatibility.

[Andrew Northall]

​PR

Implementation details and further comments on GitHub.

[Mariusz Felisiak]

Marking as "needs improvement" per ​comment.