
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
The file upload extension for the Flarum forum with insane intelligence.
An extension that handles file uploads intelligently for your forum.
Install manually with composer:
composer require fof/upload
composer require fof/upload
php flarum migrate
php flarum cache:clear
This extension replaces Flagrow Upload.
To upgrade from the old extension to the new one:
Backup your data! You should backup the database and the uploaded files.
Make sure the latest version of Flagrow upload is installed and migrations have run:
composer require flagrow/upload
composer show flagrow/upload # You should see "versions: * 0.7.1" on the 4th line of output
php flarum migrate
Disable the Upload extension in the admin panel.
Run:
composer require fof/upload
Composer should let you know that flagrow/upload has been automatically removed.
Enable the new extension in the admin panel.
Your existing configuration and uploads meta will be migrated to FoF Upload automatically.
The same file locations on the disk are used by FoF Upload, it means the files don't need to be moved.
Enable the extension, a new tab will appear on the left hand side. This separate settings page allows you to further configure the extension.
Make sure you configure the upload permission on the permissions page as well.
Regular expressions allow you a lot of freedom, but they are also very difficult to understand. Here are some pointers, but feel free to ask for help on the official Flarum forums.
In case you want to allow all regular file types including video, music, compressed files and images, use this:
(video\/(3gpp|mp4|mpeg|quicktime|webm))|(audio\/(aiff|midi|mpeg|mp4))|(image\/(gif|jpeg|png))|(application\/(x-(7z|rar|zip)-compressed|zip|arj|x-(bzip2|gzip|lha|stuffit|tar)|pdf))
A mimetype consists of a primary and secondary type. The primary type can be image, video and application for instance.
The secondary is like a more detailed specification, eg png, pdf etc. These two are divided by a /, in regex you have to escape this character by using: \/.
In some circumstances, you may wish to either disable an adapter, or force the use of one. This is set in your root extend.php file.
For example, you may disable imgur
(new FoF\Upload\Extend\Adapters())
->disable('imgur'),
Chaining of multiple commands is also possible:
(new FoF\Upload\Extend\Adapters())
->disable('imgur')
->disable('aws-s3'),
You may also force an adapter:
(new FoF\Upload\Extend\Adapters())
->force('imgur'),
Adapter names currently available:
localimgurqiniuaws-s3An extension by FriendsOfFlarum
FAQs
The file upload extension for the Flarum forum with insane intelligence.
We found that 0.1.x-dev/upload demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.