Add ignoreCheckUploadedFile option to File validator (Fixes #16710)

phalcon/Filter/Validation/Validator/File.zep

@@ -111,22 +111,23 @@ class File extends AbstractValidatorComposite
      *     'maxResolution' => '1000x1000',
      *     'messageMaxResolution' => '',
      *     'includedMaxResolution' => false,
-     *     'minResolution => '500x500',
+     *     'minResolution' => '500x500',
      *     'includedMinResolution' => false,
      *     'messageMinResolution' => '',
      *     'equalResolution' => '1000x1000',
      *     'messageEqualResolution' => '',
      *     'allowEmpty' => false,
      *     'messageFileEmpty' => '',
      *     'messageIniSize' => '',
-     *     'messageValid' => ''
+     *     'messageValid' => '',
+     *     'ignoreCheckUploadedFile' => false
      * ]
      */
     public function __construct(array! options = [])
     {
         var helper, included = null, key, message = null,
             messageFileEmpty = null, messageIniSize = null, messageValid = null,
-            validator, value;
+            validator, value, ignoreFlag;
 
         let helper = new Get();
 
@@ -145,7 +146,15 @@ class File extends AbstractValidatorComposite
             unset options["messageValid"];
         }
 
-        // create individual validators
+        /**
+         * Store ignoreCheckUploadedFile option internally
+         */
+        if isset options["ignoreCheckUploadedFile"] {
+            let this->options["ignoreCheckUploadedFile"] = options["ignoreCheckUploadedFile"];
+            unset options["ignoreCheckUploadedFile"];
+        }
+
+        // Create individual validators
         for key, value in options {
             // min file size
             if strcasecmp(key, "minSize") === 0 {
@@ -280,6 +289,15 @@ class File extends AbstractValidatorComposite
             let this->validators[] = validator;
         }
 
+        /**
+         * Propagate ignoreCheckUploadedFile option to all sub-validators
+         */
+        if fetch ignoreFlag, this->options["ignoreCheckUploadedFile"] {
+            for validator in this->validators {
+                validator->setOption("ignoreCheckUploadedFile", ignoreFlag);
+            }
+        }
+
         parent::__construct(options);
     }
 }

phalcon/Filter/Validation/Validator/File/AbstractFile.zep

@@ -1,4 +1,3 @@
-
 /**
  * This file is part of the Phalcon Framework.
  *
@@ -87,9 +86,14 @@ abstract class AbstractFile extends AbstractValidator
      */
     public function checkUpload(<Validation> validation, string field) -> bool
     {
-        return this->checkUploadMaxSize(validation, field) &&
-            this->checkUploadIsEmpty(validation, field) &&
-            this->checkUploadIsValid(validation, field);
+        if this->getOption("ignoreCheckUploadedFile") {
+            return this->checkUploadMaxSize(validation, field)
+                && this->checkUploadIsValid(validation, field);
+        }
+
+        return this->checkUploadMaxSize(validation, field)
+            && this->checkUploadIsEmpty(validation, field)
+            && this->checkUploadIsValid(validation, field);
     }
 
     /**
@@ -105,18 +109,44 @@ abstract class AbstractFile extends AbstractValidator
         <Validation> validation,
         string field
     ) -> bool {
-        var label, replacePairs, value;
+        var value, label, replacePairs;
 
         let value = validation->getValue(field);
 
+        // If the value is not an array, we consider it valid (no file provided)
+        if !is_array(value) {
+            return true;
+        }
+
+        // Case: ignoreCheckUploadedFile = true
+        if this->getOption("ignoreCheckUploadedFile") {
+            // Only check for minimum required keys
+            if isset(value["name"]) && isset(value["tmp_name"]) && value["error"] === 0 {
+                return true;
+            }
+
+            // Missing required keys -> append error message
+            let label        = this->prepareLabel(validation, field);
+            let replacePairs = [":field" : label];
+
+            validation->appendMessage(
+                new Message(
+                    strtr(this->getMessageFileEmpty(), replacePairs),
+                    field,
+                    get_class(this),
+                    this->prepareCode(field)
+                )
+            );
+
+            return false;
+        }
+
+        // Case: Normal strict validation
         if (
-            is_array(value) &&
-            (
-                true !== isset(value["error"]) ||
-                true !== isset(value["tmp_name"]) ||
-                value["error"] !== UPLOAD_ERR_OK ||
-                true !== this->checkIsUploadedFile(value["tmp_name"])
-            )
+            !isset(value["error"]) ||
+            !isset(value["tmp_name"]) ||
+            value["error"] !== UPLOAD_ERR_OK ||
+            !this->checkIsUploadedFile(value["tmp_name"])
         ) {
             let label        = this->prepareLabel(validation, field);
             let replacePairs = [
@@ -205,6 +235,11 @@ abstract class AbstractFile extends AbstractValidator
         let method = "GET";
         let length = 0;
 
+        // Skip all max size and POST-size checks when ignoreCheckUploadedFile is true
+        if this->getOption("ignoreCheckUploadedFile") {
+            return true;
+        }
+
         if _SERVER {
             let server = _SERVER;
         }
@@ -388,6 +423,18 @@ abstract class AbstractFile extends AbstractValidator
      */
     protected function checkIsUploadedFile(string name) -> bool
     {
+        /**
+         * When ignoreCheckUploadedFile = true,
+         * skip the system-level check (is_uploaded_file)
+         * but still ensure that the file physically exists.
+         *
+         * This allows CLI / test environments to validate
+         * fake uploads safely.
+         */
+        if this->getOption("ignoreCheckUploadedFile") {
+            return file_exists(name);
+        }
+
         return is_uploaded_file(name);
     }
 }

tests/unit/Filter/Validation/Validator/FileCest.php

@@ -0,0 +1,68 @@
+<?php
+
+/**
+ * This file is part of the Phalcon Framework.
+ *
+ * (c) Phalcon Team <team@phalcon.io>
+ *
+ * For the full copyright and license information, please view the
+ * LICENSE.txt file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Phalcon\Tests\Unit\Filter\Validation\Validator;
+
+use Phalcon\Filter\Validation;
+use Phalcon\Filter\Validation\Validator\File;
+use UnitTester;
+
+class FileCest
+{
+    /**
+     * Tests File validator with `ignoreCheckUploadedFile = true`
+     *
+     * This test creates a temporary file instead of relying on
+     * a static file under `tests/_data` to make it fully
+     * self-contained and environment independent.
+     *
+     * @param UnitTester $I
+     */
+    public function fileIgnoreCheckUploadedFile(UnitTester $I): void
+    {
+        $I->wantToTest('Filter\Validation\Validator\File - ignoreCheckUploadedFile works');
+
+        $validation = new Validation();
+        $validation->add(
+            'file',
+            new File([
+                'maxSize'                 => '2M',
+                'ignoreCheckUploadedFile' => true,
+                'allowEmpty'              => false,
+                'types'                   => ['text/plain'],
+            ])
+        );
+
+        // Create a temporary file to simulate an uploaded file
+        $tmpFile = tempnam(sys_get_temp_dir(), 'phalcon_test_');
+        file_put_contents($tmpFile, 'dummy content');
+
+        // Fake uploaded file array
+        $fakeFile = [
+            'name'     => 'test.txt',
+            'type'     => 'text/plain',
+            'tmp_name' => $tmpFile,
+            'error'    => 0,
+            'size'     => filesize($tmpFile),
+        ];
+
+        $messages = $validation->validate([
+            'file' => $fakeFile,
+        ]);
+
+        $I->assertEmpty($messages);
+
+        // Clean up the temporary file
+        @unlink($tmpFile);
+    }
+}