File uploads in forms

An Image or File field in a form shows a file chooser. The file is uploaded together with the rest of the form, checked, and added to your Media Library. The field then stores the attachment.

Which fields

• Image and File fields of a field group (post, profile and registration forms) or columns of a data table (entry forms).
• They must be top-level fields. An upload inside a Group or Repeater is not supported; such a container is marked Not available in forms in the editor.
• Gallery fields are not available in forms.

Allowed file types

Set them on the field itself: open the field in its field group (or the data table column) and fill Allowed file types (Type settings): "Comma-separated extensions, e.g. jpg, png, pdf. Leave empty to allow all."

The default list for guests keeps archives, scripts and executables out of your Media Library. Change it with the wpmcf/forms/guest_file_types filter (it receives the list of extensions and the field).

The file chooser shows only the allowed types (the browser's accept list); that is a convenience, the real check runs on the server.

What is checked

Before anything is created (no post, no user, no row), each file is checked:

1. Size. The file must not be larger than the limit (below).
2. Upload completed. An empty or interrupted upload is refused: "The file for "CV" could not be uploaded."
3. Type. WordPress looks at the file's contents and its name. The extension must be allowed, and the contents must fit it: a text file renamed cv.pdf is refused, as are .php, .exe and .js files. For an Image field the file must also be a readable image.

If any check fails the whole submission is refused and the form shows the message next to the field: "The file for "CV" is not an allowed type." / "The file for "CV" is larger than 2 MB." Nothing is saved. The visitor has to choose the file again (browsers do not keep file choices).

Size limit

The default limit is the smaller of your server's upload limit and 10 MB. The server limit is PHP's upload_max_filesize / post_max_size as WordPress reports it (Media › Add New shows it, often 2 MB on small hosts). A file above the PHP limit never reaches the plugin; the visitor sees the form again with "The file for "x" is larger than ..." when PHP reported the limit to the plugin. When the whole request is bigger than post_max_size, PHP drops it completely and the visitor just gets the page again, without any message.

To change the plugin's limit use the filter:

add_filter( 'wpmcf/forms/upload_max_bytes', function ( int $bytes, $field, $context ): int {
	return 5 * MB_IN_BYTES; // 5 MB for every file field
}, 10, 3 );

$field is the field definition ($field->key tells which field) and $context the form (a FormDTO) or, for the files that come through a form connection, the connection. Raising the filter above PHP's limits does not raise PHP's limits: change upload_max_filesize and post_max_size on the server as well.

Where the file goes

After the entry exists, the file is added to the Media Library (under the normal wp-content/uploads/year/month folder with a safe file name), its thumbnails are created, and the attachment ID is stored in the field:

The title of the attachment is the file name without extension.

If a file cannot be stored after the entry was saved (disk full, for example) the entry stays and the success message gets the note "The file for "CV" could not be saved." added; your Redirect to address is not used in that case so the visitor can read it. In an entry form, a required file column that fails to store makes the whole submission fail, and files already stored for it are deleted again. When an entry form fails for another reason after files were stored, those files are deleted too.

Editing: replace or remove

When a form edits an existing post or user that already has a file, the field shows the file's name, a Remove checkbox and the chooser:

• choose a new file to replace it;
• tick Remove to clear the field;
• do nothing to keep it.

A visitor can only keep the file the entry already has: an attachment ID typed into the page is ignored, so nobody can attach another person's media.

Things to know

• Uploaded files are public in the Media Library like any attachment, and guests' files are visible at their URL. Do not collect secrets this way.
• Uploads from guests land in your Media Library. Keep the rate limit on and review the library from time to time (Guests and spam protection).
• There is no virus scan.
• One file per field. For several files add several fields.
• The same checks apply to files that other form plugins collect when you use a form connection with a file column.