Hi everyone,
I have been a long-time user of PHPMaker, and in previous versions, I used to store my uploaded images outside the project root folder for two main reasons:
-
Security: To prevent public users from discovering the project’s internal directory structure via image URLs.
-
Backup Management: To keep user-generated content (images) separate from the project source code for easier backup and deployment.
In previous versions, I simply used a relative path with a parent directory prefix like this:
'UPLOAD_DEST_PATH' => "../image/",
This worked perfectly fine. However, in PHPMaker 2026, this configuration no longer works. The files are not saved unless I define the path inside the project folder (e.g., 'UPLOAD_DEST_PATH' => "image/",).
It seems like the new version is more restrictive about paths containing ../ or paths outside the project root.
My Questions:
-
Is there a new security setting or validation in PHPMaker 2026 that prevents using
../in the upload path? -
What is the recommended way in PHPMaker 2026 to store uploaded files in a directory outside the project folder?
-
How should I define the “Local file system root” if I want to keep my uploads at a sibling level to the project folder?
I would appreciate any guidance or workarounds for this.
Best regards,
Ehsan