I'm having problems downloading files uploaded using the Upload file question type. Where are these files stored? How can I download them?

You can download them in "browse response" page.

Denis

Thanks Dennis,

I cannot download them from the browse response page because ALL files uploaded by 150+ people are corrupted.

So I'd like to check if the files are corrupted after downloading them or when uploading them.

To find 1 or 2 corrupted files wouldn't be anything out of the ordinary...but every single file is not a coincidence.

so, I'd like to know if there's a way to get to those files that is not through the browse/display response page

Hi,

In the database you have the new filename : something like this jgftftsqd5454hhgh .
And the file are in
./upload/survey/{SID}/files

Denis

but this is not very helpfull, because not only the filename is changed, also the extension, so I can't get directly from the directory, I have to get it from the responses view.

Also if I try to download it from the resources menu, I get the zip with this wrong file name and wrong file extension.

So, there's anyway to get the file directly from the directory?

thanks
regards

hi, I am accessing the folder where uploaded images are stored in limesurvey. the problem is that all images and pdfs are stored as fu_zytptcq2zpbwtsd with no indication whatsoever about the type of file (pdf, jpg, etc). so once I download it into my pc, I can only find out the content of the file in my mac because preview is smart enough as to convert what ever it is and display it. but in windows I just cant find out how to determine the type of file I am dealing with, no extension, no indication as for the file type. how can I transform whatever limesurvey is doing to the uploaded files into something usable?

The filenames are intentionally obfuscated. The simplest workaround would be to send yourself a basic or detailed notification email and click on the "view response" link. From there you can download the file.

alexgarciac wrote: I can only find out the content of the file in my mac because preview is smart enough as to convert what ever it is and display it. but in windows I just cant find out how to determine the type of file

To find out the type of files you might try some of these tools:
www.raymond.cc/blog/what-file-is-that-ho...es-types-and-format/

A obfuscation with filetypesuffix in cleartext wouldn't raise the risk of file exposure to third parties that much.
At least not for direct access via URL/path

PS : this file upload question type must be really rewrited for
- Save file elsewhere on the disk (with a cleaner file name, but out of web access)
or
- Save file in DB

I also find it strange that it seems so complicated to get to these uploaded files. I mean, security of the files is important, but if it is so complicated (never used this question type, I only see the confusion on the forum), then this question type is basically useless for most users, because they don't know how to get to their files.

@holch : currently : we are unsure user have access to a directory out of web. This system is used with very important thing sometimes ( CV/ Contract / id card etc ...) then we must NOT show it publicly.

Like i put in the report : i think there are only 2 ways to have a clean upload file system
- Save in DB only : it's more difficult to find it ...
- Save on the server out of web server : need configuration

If anyone are interested by a plugin : 'moveFileUploadToDir' when survey is submitted : i can make an offer.

The obfuscation is OK.

The issues around fileuploads storage are always:

1.) Preventing access via guessing a direct link to the file. E.g. when the pattern of the files is widely known.
2.) Prevent access when PHP is not working (correctly). E.g. php code will be displayed in the browser.
3.) Prevent access when Webserver is not working (correctly). E.g. htaccess no longer working.
4.) Make is easy to download file for survey admin.

For me the biggest issue with the current file upload question is the lacking of removing the files when deleting the survey and the database. The whole application gives the user the impression that the uploaded files are gone too.
The uploaded files stay on the server.

An option to config the upload path would be a good idea. That will allow people to move the storage location outside the webroot. Most people won't change it. But security gets improved. Same should be done with the databasebackup during the comfortupdate. These are also at risk of getting downloaded.

BTW: I always wonder why people use LimeSurvey for creating online-forms. Even the simplest address form looks strange with LS (E.g. too much space between the text inputs. No free positioning of fields.)
In public surveys the upload question is not that commonly used.