How to validate temporary files with form API

Question

Problem

I have a custom form with three file fields. The files are selected, then on submit they're attached to an email and sent off with a call to hook_mail.

I'm pretty sure the files aren't saved to the server and I don't want them saved as the files might be sensitive information.

But I want the fields to support certain file extensions. How can I validate them?

So Far

There is a function: file_validate_extensions which can validate but it only works for Drupal file objects and since these are never uploaded I'm not sure that works.

I tried using file_save_upload, as when a file is selected in a form (and not immediately uploaded) it's information appears in $_FILES so I tried to load the temporary path given there however it doesn't work.

(The path is of the form: C:\XAMPP\tmp\phpEDC6.tmp)

function mymodule_form_submit($form, $form_state) {
    $coverincluded = file_save_upload($_FILES['files']['tmp_name']['cover_letter_included'],
       array(
          'file_validate_is_image' => array(), // Validates file is really an image.
          'file_validate_extensions' => array('png gif jpg jpeg'), // Validate extensions.
       ));

     //unfortunately this dpm never shows, presumably because file_save_upload hasn't worked
      dpm($coverincluded);
 }

Answer 1

This isn't a particularly clever solution, but hopefully it's ok. As far as I could tell you can't validate temporary files, they have to be uploaded.

So I ended up uploading them to the private directory and then immediately deleting them. Because some of the data might be sensitive I don't want to store them and this form takes place on a secure page.

function mymodule_form($form, &$form_state) {

   $form['file1'] = array(
     '#type' => 'file',
     '#title' => t('File1'),
   );

   $form['file2'] = array(
     '#type' => 'file',
     '#title' => t('File2'),
   );


}

Now for the important bit.

function mymodule_form_submit ($form, &$form_state) {
    //check if any file was attached
    if($_FILES['files']['tmp_name']['file1'] != '') {
      //Save and validate the file to the private file area
      $file1_included = file_save_upload('file1_included',
                                     array(
                                        'file_validate_is_image' => array(), // Validates file is really an image.
                                        'file_validate_extensions' => array('png gif jpg jpeg'), // Validate extensions.
                                      ), 'private://');
      //This is set-up for the email. Mimemail stores attachments in $params.
      $params['4'] =  array('uri'    => $file1_included->uri,
                          'filename' => $file1_included->filename,);
      //The file has been uploaded. So we'll set a variable which will be called later to delete it.
      $del_files['file1'] = $file1_included;

    }

   if($_FILES['files']['tmp_name']['file2'] != '') {
   //.... same as file 1...
   }    

  //this will send an email. Note $params. We've put all our attachment information in 
  //there.
  $message = drupal_mail('mymodule', 'notify', $email, language_default(), $params);

  //This function will delete all the files we've just uploaded. We check if
  //the variable has been set. And if it has then we call it and delete the relevant
  //files.

  if (isset($del_files)){
    _tellafriend_filedelete($del_files);
  }

}

This is the function we call to delete the files

function _mymodule_filedelete(&$del_files){
   //we know the variable exists, but now we have to check which files were uploaded.
   if(array_key_exists('file1' , $del_files)) {
    //and if they were uploaded. We delete them.
    file_delete($del_files['file1']);
  }
   if(array_key_exists('file2' , $del_files)) {
    file_delete($del_files['file2']);
  }
}