Let editors upload files to an article

[bonelifer]

What this does

Lets editors upload images and files to an article, and place them in the text with [[File:name]]. This is the "File uploads" item from docs/TODO.md.

• Storage. A new wiki_file table and the folder store/phpbbmodders_wiki/. Files belong to the article, not to one version of it. They are stored under random names with no extension, and the folder is created with a .htaccess that denies direct access.
• Reading. Files are read only through the wiki's own controller, which checks that the reader may view the wiki and that the article has a live version (or that the reader may view inactive articles). Images that phpBB verifies as GIF, JPEG, PNG or WebP are shown inline; everything else, including SVG and HTML, is only ever sent as a download, with nosniff and a restrictive Content-Security-Policy.
• Limits. phpBB's own upload class checks each file against the file types the board allows in every forum and the board's maximum file size, and rejects content that looks like HTML or script. A file name is cleaned so it can be written inside [[File:…]], and a name already used in the article is refused.
• Permission. A new "Can upload files to articles" permission (u_wiki_upload). Nobody has it until an administrator gives it. The member who uploaded a file can delete it, and so can a moderator with the existing "Can delete versions of an article" permission. Deleting asks for confirmation. Deleting an article deletes its files from the table and the disk.
• In the text. [[File:Diagram.png]] shows an uploaded image, [[File:notes.zip|the notes]] links to any other file with that link text, and a name that was never uploaded stays plain text with a hint. [[File:…]] looks only at the files of the article being shown, so in a forum post it stays plain text. Ordinary [[Article]] links are unchanged.
• Page. Each article gets a Files section: the list with sizes, uploaders and the embed syntax, and the upload form for members who may upload.
• German strings, a README paragraph, and removal of the TODO entry.

Testing

Claude ran the same two end-to-end scripts on phpBB 3.3.19 and phpBB 4.0 (master) boards, and a shorter run on throwaway MySQL 8.0 and PostgreSQL 16 boards:

• the upload form shows only to members with the permission; PNG and ZIP uploads work; PHP, HTML, a text file renamed .png, an empty submit and a duplicate name are refused with worded errors; a file over the board's size limit is refused; an upload without the form token is refused;
• files sit on disk without an extension, the PNG is served inline as image/png and the ZIP as a download, both with nosniff; a file id under another article is not found; a file of an article with no live version is hidden from a reader;
• an embedded image loads in the page, a ZIP embeds as a link with its link text, a missing file stays plain text, and normal [[links]] still work;
• another uploader cannot delete a file, a moderator can, delete asks first, an uploader can delete their own file, and deleting the article removes its files from the table and the disk;
• on MySQL and PostgreSQL: the table and permission exist after enabling, and upload, serving, embedding, deleting one file and deleting the article all work (17 checks each).

Nine new unit tests cover file name cleaning, which types show inline, and the [[File:]] syntax against the real s9e text formatter configuration (it must become its own tag and must not turn into a link). The new and changed PHP files lint clean on PHP 8.5.

Known limits

• An article saved before this change that already contains [[File:x]] was stored as a link to an article called "File:x". It shows as a link until the article is saved again or reparsed.
• Only the board's global maximum size applies, not a per-group size; only file types allowed in every forum are accepted.
• Files are not versioned: they stay with the article when a version is deleted. There are no thumbnails.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).