form file upload loses file when validation fails

It is a bit scary that Django looses file uploads when validation fails. There are already Stackoverflow issues like this, and the django-file-resubmit app that tries to address that problem (4 years without commit - maintained?)

Is there a “Django” way to solve this issue once and for all? I accept that it is a security issue that a browser can’t pre-fill a filefield in a GET request. But then, Django, knowing this, must automatically store the file elsewhere temporarily until the form is submitted.

It shouldn’t be necessary to use an external module for that. It should be in Django core.

Thoughts?

Why would it be “scary”? This is precisely what I would hope it would do.

I disagree. You don’t normally keep data from submitted forms that are invalid. If you want to do this, then I do believe that constitutes a “special-case” that needs to be handled differently.

If you want to handle this yourself, you do have multiple options.

Yes, you can implement the logic used by `django-file-resubmit to maintain a cache of “uploaded-but-not-commited” files. (You then need to manage that cache to ensure you don’t have a boundless number of useless files hanging around.

Or, you could make the file upload a separate step. Have the user fill out the form with the necessary data, then present a follow-up form for the upload.

Or, you could implement an “AJAX-style” validation of the form data. Submit the non-input fields via AJAX, and then permit the file upload to proceed once the form data has been validated.

1 Like

Yes, that may be a few options. The file resubmit module did not convince me.
I think I will go the separate step way, this fits better into the workflow.
Thanks for the separation of thoughts here.

Or, you could implement an “AJAX-style” validation of the form data. Submit the non-input fields via AJAX, and then permit the file upload to proceed once the form data has been validated.

What do you mean with “non-input fields”?

Sorry, very bad edit on my part. That should be “non-file” input fields. In other words, all fields other than the file uploads.

Thanks! Clear then! If you want we can delete the last 2 posts - to reduce spam, and you correct the word in your answer?