Changelog – Cart Upload Pro (Order) for Shopware 6

2.4.0

• Security: uploaded customer files can now be stored outside the public directory and delivered only through signed, time-limited links. Previously they sat under public/order-uploads/ and could be retrieved by anyone who knew the path. See Protecting files.
• New: setting "Store uploads privately and use signed download links". On for fresh installations; left off when an existing shop updates, so nothing changes for you at first.
• New: setting "Download link lifetime in days" (default 90, 0 = unlimited). It only affects links in emails that have already been sent; links in the customer account and in the administration are generated fresh on every request and never expire.
• New: setting "Keep serving legacy public paths" (default on), so links in emails sent before the changeover keep working.
• New: uploads now carry a ready-made link (upload.downloadUrl). The email template no longer has to assemble the path itself. Please switch your template to {{ upload.downloadUrl }}; the documentation shows the before and after.
• New: command bin/console futi:order-uploads:migrate to move existing files, with --dry-run to check first and --purge-public as a separate second step.
• New: a notice in the plugin settings for as long as files remain in the public directory.
• Fix: the upload area never appeared on the cart page — neither the upload field nor the notice for customers who are not logged in. The template targeted a block that only exists on the confirmation page, so uploading was only possible during checkout.
• Fix: in the customer account the list of uploaded files ran across the order table without a frame or spacing. It is now presented just like in the cart and on the confirmation page.
• Fix: entering the allowed file types without quotes (txt,pdf or .txt,.pdf instead of 'txt','pdf') made the upload field disappear without a word. Both notations are now accepted.
• Internal: all file access goes through Shopware's filesystem abstraction instead of the local disk. The file type setting is no longer evaluated through eval.

2.3.0

• New: uploads are now available through the Store API. Headless and PWA frontends use the same upload flow as the storefront — see Store API (Headless).
• Security: uploads are checked to make sure the declared cart belongs to the caller.
• Security: deleting is checked to make sure the file belongs to the caller's cart. Previously knowing the file id was enough.
• The upload logic of storefront and Store API now lives in one place.

2.2.1

• Fix: when customers uploaded several files sharing the same file name, those files were stored under the same path in the cache directory. They overwrote each other and on checkout only the first file made it into the order — the remaining entries were visible in the administration but could not be downloaded. Every file now gets its own directory.
• Fix: if the uploaded file is missing, no entry is attached to the order any more. Previously this produced an entry with a dead download link; the incident is now written to the log instead.
• Fix: an error while storing an upload can no longer abort the checkout.

2.2.0

• New: "Start upload automatically" setting — when enabled, a file is uploaded immediately after it is selected or dropped and the upload button is omitted, restoring the behaviour of versions up to 2.0.x. Default: off (images can only be edited before uploading when it is off).

2.1.2

• Webcam support: customers can capture and upload photos directly via the device camera (based on @uppy/webcam)
• Internal improvements: file handling moved to the Shopware filesystem (Flysystem), performance improvements
• Requires Shopware 6.7

2.1.0

• Added webcam support (based on @uppy/webcam)
• Requires Shopware 6.7

2.0.0

• Updated the plugin for Shopware 6.7

1.3.0

In this version a new file uploader was integrated. The Uppy uploader was chosen for this purpose.

The core and the dashboard were integrated first. New additions are the image editor and thumbnail generation.

Further functionality is planned to be built on this foundation, such as uploading from remote sources like Instagram, Google Drive, Dropbox and others, or direct data transfer to an S3 bucket or an S3-compatible provider such as Google Cloud Storage.

The settings in the plugin configuration and the email template remain unchanged and do not need to be adjusted.