jweiland / checkfaluploads

6.0.1 2026-09-08 09:58 UTC

Requires

• typo3/cms-core: ^13.4
• typo3/cms-filelist: ^13.4

Requires (Dev)

• ergebnis/composer-normalize: ^2.44
• friendsofphp/php-cs-fixer: ^3.14
• phpstan/phpstan: ^1.10
• roave/security-advisories: dev-latest
• typo3/cms-form: ^13.4
• typo3/coding-standards: ^0.8
• typo3/testing-framework: ^9.0.1

Replaces

• typo3-ter/checkfaluploads: 6.0.1

GPL-2.0-or-later

• Stefan Froemken
• Hoja Mustaffa Abdul Latheef

• typo3
• TYPO3 CMS
• checkfaluploads

Published on Packagist.org on 2026-09-08 10:00 UTC

README

What is checkfaluploads?

checkfaluploads adds a checkbox to every place in the TYPO3 backend where editors can upload a file: the File List module, the ElementBrowser, and inline file/media fields on records. Editors must confirm it before an upload is accepted, and it grants the owner you configure unrestricted rights to use that file. The extension also stores the uploading user's UID on the sys_file record, so administrators can see and filter files by who uploaded them.

Why you need it

Editors upload images and documents to TYPO3 all the time, and not every one of them actually holds the usage rights to what they upload. Without an explicit confirmation step, a site owner has no record of who uploaded a given file or whether anyone ever checked that its use was permitted, which becomes a real problem the moment a rights holder complains. checkfaluploads closes that gap: no confirmation, no upload, and a cruser_id / fe_cruser_id trail on sys_file afterward, so you can always trace a file back to whoever put it there.

That coverage has limits worth knowing before you rely on it. It only protects what TYPO3 core itself handles: the File List module, the ElementBrowser, and inline file/media fields in FormEngine. Installing checkfaluploads does not retroactively guarantee that every sys_file record in your installation carries a rights confirmation or an uploader ID. Extensions with their own upload logic, powermail's file upload field being one example, need a developer to wire in the FalUploadService / CheckFalUploadValidator API by hand (see the Developer manual); installing checkfaluploads alone does not cover them. And for frontend forms without a login, a job application form for example, there is no frontend user to begin with: no session means no user ID, regardless of what checkfaluploads does.

Features

• Adds an image rights checkbox to the File List module
• Adds the same checkbox to the ElementBrowser's upload form
• Adds the same checkbox to inline file/media upload buttons in FormEngine (e.g. "Select & upload files")
• Stores the FE or BE user UID of the uploader on the sys_file record
• Ships an API to add your own image rights checkbox to Extbase and/or EXT:form forms

Installation

Using Composer

The recommended way to install the extension is via Composer. Run this inside your Composer based TYPO3 project:

composer require jweiland/checkfaluploads
vendor/bin/typo3 extension:setup --extension=checkfaluploads

Using the TYPO3 Extension Repository (TER)

On non-Composer-based installations, download and install checkfaluploads via the Extension Manager module instead.

Configuration

After installing, open **Admin Tools > Settings > Extension Configuration

checkfaluploads** and set the Owner field to whoever should receive the usage rights (e.g. your company name). Until you do, the checkbox label falls back to a placeholder like [Missing owner in ext settings of checkfaluploads] instead of a real name, so this step is not optional.

Support

Free Support is available via GitHub Issue Tracker.

For commercial support, please contact us at [e-mail].