Enhancements to Mostly Static Resources (CFM-62) #442

arlen · 2026-08-18T00:07:16Z

This PR does a number of things:

It allows mostly static resources to be cached and implements etags for them
It provides a post_max_size check as middleware to avoid a white-screen exception if a user uploads a file that is too large for that PHP setting
It displays image-based resources in the edit/view view
It automatically sets an appropriate slug for the resource (with JavaScript)
It allows relative media to be embedded while using the HtmlSanitizer library (so that resources can be used in themes)
It allows the resource URL to be copied using our Vuejs component (this PR shows an example of embedding a Vuejs component in a fields.inc file)

Here is the edit view:

arlen · 2026-08-18T13:30:20Z

The force-push was to rebase against the latest develop.

benno · 2026-09-06T18:34:25Z

app/config/app.php

+        // Allow caching: since the introduction of Mostly Static Resources, v5.3.0
+        'ini' => [
+          'session.cache_limiter' => '',
+        ],


I can't find this in the documentation, are you sure this is the write key and that it's still supported? (I see cacheLimiter referenced in Cake 2.)

Also, the comment "allow caching" doesn't semantically match what Cake 2 says this would do (define the cache control headers) and implies you're trying to turn on application level caching, which I don't think is what you're trying to do?

I think this is a legitimate way to do this. See: https://book.cakephp.org/5.x/development/sessions.html#setting-ini-directives

I agree that the comment isn't very exact. I can update the comment to something like:
// Prevent PHP's session handling from forcing no-cache headers onto every
// response, so actions like MostlyStaticResourcesController::deliver()
// can set their own explicit HTTP caching headers (since v5.3.0).

Inline code comment has been updated to that shown above.

app/resources/locales/en_US/field.po

benno · 2026-09-06T18:52:06Z

app/src/Model/Table/MostlyStaticResourcesTable.php

-    // lowercase alphanumeric characters and dashes
+    // lowercase alphanumeric characters, dashes, underscores, and periods (for allowing extensions)
    $validator->add('name', [
      'slugfilter' => [
-        'rule' => ['custom', '/^[a-z0-9-]+$/'],
+        'rule' => ['custom', '/^[a-z0-9._\-]+$/'],


This makes me uncomfortable, though I'm not sure I have a good reason other than it's deviating from the out of the box pattern.

Cake 3+ uses dashes, not underscores, in URLs. I get that someone might upload a file with an underscore, but we don't need to preserve the filename exactly as uploaded.

Allowing periods for extensions also allows them for poorly constructed filenames. But maybe that's not a problem we should really be solving.

My goal here was to allow filenames to upload with minimal transformation - and dots and underscores are fairly common in image filenames (I much prefer dashes). I'm ok with skipping underscores or enforcing their change to dashes if we feel strongly about this.

On extensions: we may not require them for rendering, since Content-Type is set explicitly from the stored mime_type column. But keeping the name field recognizable/familiar to whoever's managing these resources through the UI feels like better UX even if just a convenience. I'm hesitant to strip the extensions.

I guess I'd prefer to preserve these - but I can compromise on the underscore. I feel more strongly about the dot (for extensions). Thoughts?

OK, in the spirit of unnecessary compromise, let's convert underscores to dashes but leave the dots.

benno · 2026-09-06T18:52:25Z

app/resources/locales/en_US/field.po

@@ -894,7 +903,7 @@ msgid "MostlyStaticResources.name"
 msgstr "Slug"

 msgid "MostlyStaticResources.name.desc"
-msgstr "The URL fragment for this Resource, which must be unique and use only lowercase alphanumeric characters and dashes (-)"
+msgstr "The URL fragment for this Resource, which must be unique and use only lowercase alphanumeric characters, dashes (-), underscores (_), and periods (.)"


See discussion in MostlyStaticResourcesTable, below.

app/src/Controller/AppController.php

app/src/Middleware/PostMaxSizeCheckMiddleware.php

app/config/routes.php

arlen · 2026-09-07T23:34:23Z

Updates made (per comments above), and this PR has been rebased against the latest develop.

benno · 2026-09-11T20:31:27Z

app/config/routes.php

+    $builder->registerMiddleware('postMaxSizeCheck', new \App\Middleware\PostMaxSizeCheckMiddleware());
+


Not specific to this PR, but it looks like these registerMiddleware statements are supposed to be defined outside of any scope?

benno · 2026-09-11T20:53:44Z

app/config/routes.php

+  $builder->connect(
+    '/add', 
+    ['controller' => 'MostlyStaticResources', 'action' => 'add']);
+  $builder->connect(
+    '/edit/{id}',
+    ['controller' => 'MostlyStaticResources', 'action' => 'edit'],
+    ['id' => '\d+', 'pass' => ['id']]
+  );


Shouldn't we inherit this from the default routes? ie, why do we need these and not delete?

benno · 2026-09-11T20:54:27Z

app/resources/locales/en_US/field.po

@@ -931,11 +934,17 @@ msgstr "This Petition is complete and has been finalized. Please contact your ad
 msgid "MostlyStaticResources.file_content"
 msgstr "File to Upload"

+msgid "MostlyStaticResources.image"
+msgstr "Resource Image"


Is there are reason not just to use "Image"? (Similarly for "Resource URL".)

benno · 2026-09-11T21:20:08Z

app/src/Middleware/PostMaxSizeCheckMiddleware.php

+    return $handler->handle($request);
+  }
+
+  protected function iniSizeToBytes(string $val): int {


Maybe just use PHP's ini_parse_quantity function instead? This imposes a minimum PHP of 8.2.0, but I think we're there already.

benno · 2026-09-11T21:21:30Z

app/src/Model/Table/MostlyStaticResourcesTable.php

-    // lowercase alphanumeric characters and dashes
+    // lowercase alphanumeric characters, dashes, underscores, and periods (for allowing extensions)
    $validator->add('name', [
      'slugfilter' => [
-        'rule' => ['custom', '/^[a-z0-9-]+$/'],
+        'rule' => ['custom', '/^[a-z0-9._\-]+$/'],


OK, in the spirit of unnecessary compromise, let's convert underscores to dashes but leave the dots.

arlen force-pushed the feature-cfm62-MsResourcesImprovements branch from 5aa1e60 to a9f042d Compare August 18, 2026 13:29

arlen force-pushed the feature-cfm62-MsResourcesImprovements branch from a9f042d to bdf81de Compare September 3, 2026 13:33

benno reviewed Sep 6, 2026

View reviewed changes

benno requested a review from Ioannis September 6, 2026 19:31

arlen added 2 commits September 7, 2026 18:27

Enhancements to Mostly Static Resources (CFM-62)

0eebb61

Refinements to Mostly Static Resources (CFM-62)

6e19811

arlen force-pushed the feature-cfm62-MsResourcesImprovements branch from bdf81de to 6e19811 Compare September 7, 2026 23:29

arlen added 2 commits September 7, 2026 19:41

Allow relative links in HTML content (CFM-62)

252f41b

Clean up postMaxSizeCheck inline comments (CFM-62)

334d77c

benno requested changes Sep 11, 2026

View reviewed changes

		$builder->registerMiddleware('postMaxSizeCheck', new \App\Middleware\PostMaxSizeCheckMiddleware());

Enhancements to Mostly Static Resources (CFM-62) #442

Are you sure you want to change the base?

Enhancements to Mostly Static Resources (CFM-62) #442

Conversation

arlen commented Aug 18, 2026

Uh oh!

arlen commented Aug 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arlen Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arlen Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arlen commented Sep 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

arlen Sep 7, 2026 •

edited

Loading

arlen Sep 7, 2026 •

edited

Loading