From d919d55b5eb7aa8e35c285a6cc0e58e9cab584bc Mon Sep 17 00:00:00 2001
From: Gani Georgiev <gani.georgiev@gmail.com>
Date: Tue, 19 Nov 2024 17:42:41 +0200
Subject: [PATCH] allow mixing existing file names and new uploaded files

---
 apis/record_crud.go      |  24 ++++++++++++++++++++++--
 apis/record_crud_test.go |   4 +++-
 tests/data/data.db       | Bin 344064 -> 344064 bytes
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/apis/record_crud.go b/apis/record_crud.go
index bf0d4a46..767318e8 100644
--- a/apis/record_crud.go
+++ b/apis/record_crud.go
@@ -13,6 +13,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/router"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
@@ -561,9 +562,28 @@ func recordDataFromRequest(e *core.RequestEvent, record *core.Record) (map[strin
 		return nil, err
 	}
 	if len(uploadedFiles) > 0 {
-		for k, v := range uploadedFiles {
-			result[k] = v
+		for k, files := range uploadedFiles {
+			uploaded := make([]any, 0, len(files))
+
+			// if not remove/prepend/append -> merge with the submitted
+			// info.Body values to prevent accidental old files deletion
+			if info.Body[k] != nil &&
+				!strings.HasPrefix(k, "+") &&
+				!strings.HasSuffix(k, "+") &&
+				!strings.HasSuffix(k, "-") {
+				existing := list.ToUniqueStringSlice(info.Body[k])
+				for _, name := range existing {
+					uploaded = append(uploaded, name)
+				}
+			}
+
+			for _, file := range files {
+				uploaded = append(uploaded, file)
+			}
+
+			result[k] = uploaded
 		}
+
 		result = record.ReplaceModifiers(result)
 	}
 
diff --git a/apis/record_crud_test.go b/apis/record_crud_test.go
index a86adf84..46dbc91f 100644
--- a/apis/record_crud_test.go
+++ b/apis/record_crud_test.go
@@ -2345,7 +2345,7 @@ func TestRecordCrudUpdate(t *testing.T) {
 	}
 
 	formData3, mp3, err3 := tests.MockMultipartData(map[string]string{
-		router.JSONPayloadKey: `{"title": "title_test3", "testPayload": 123}`,
+		router.JSONPayloadKey: `{"title": "title_test3", "testPayload": 123, "files":"300_JdfBOieXAW.png"}`,
 	}, "files")
 	if err3 != nil {
 		t.Fatal(err3)
@@ -2686,6 +2686,8 @@ func TestRecordCrudUpdate(t *testing.T) {
 				`"id":"mk5fmymtx4wsprk"`,
 				`"title":"title_test3"`,
 				`"files":["`,
+				`"300_JdfBOieXAW.png"`,
+				`"tmpfile_`,
 			},
 			ExpectedEvents: map[string]int{
 				"*":                          0,
diff --git a/tests/data/data.db b/tests/data/data.db
index 50892db4fd8d53d48a3bb3aead48e013f4ee94aa..e22b80d180002d7b8f1d687caff587f3cce1e6ec 100644
GIT binary patch
delta 1710
zcmah}ZERCj7{2$O(|h}|_O?LNZHVpa_^2DRx8HYsc3WpQU}bANMh9z4+d&82x^*8g
zRC)&+5J0zF<OEF^7!r*R#58b0GJhb%7#$H!Ffl3^|L_AOB>vJ!ylr88gy@fR?wj+z
z&wI}MzV~@D8Eqz`9iOjh#xTq;uGQkgF$^A@sI=nEpM_7;pa$;bDfM0g?#xc8?*h}}
zwZKC%PR41mTJ3f=G-$4}SVPIg*1kx8+*Y-<2O}4IvOkR<$)1`QRe%~Y!&3%^ATwE)
zp`I)=01y6O=(X8Xi^3+Q@-Ga)X^gxMr{$gE#c_~L`x<fiK9xdKA=Orl`gqvEqmDYb
z=-5}pa{iAFGwkxRUS7XB&hHP!^bE6<VGWGE+QL@btW~U;3AS(Eua)P}x<f1YH+=_Z
z(P;bvF%PYBK?*vZ4cqxQ{JpSYi*JB`;Qt4@)5B);+X}dg-`<+hK9|;IcZzAVox!63
zVi-YYA8vldB0Emk(%a}!`gm5e`i_d9Guhlozk^9I8PMT_iTDsBn*&UED892l-q#)3
z;U4JUmR3G?TIAvk<lO_wcwb^JsK5(WG?a*ia#+RQGn2xZN!)KH#kgX;3sK+UM!Ji*
zB3T6Q!6f({M2UN1$Cl#sNH9w2Mgrod)8V5s;rI>wRa{nSFs9?({r(=L{s1opCR2>>
zk-Ve~_4KFGAtwJ>D_s2^9|MFbl5_2!xQPoBH;L4)Ws+{J1fL@4eX5755tUjwt|W`b
ziq!IQS+6up-K9=YZgFIPLk<G4o47*^OFqP>$mNPAoZ=_chxc$?h|^Qrg$t#7CAn%s
z{qbZfWZ&49ZW(^su5IzS{T@SWgJ**w{KUbPJwlJjo}hihja^Okg`k4{0(8NF-V1=v
z;zq8N(&}{5k)d3Y++y+@Drp7hh2a+PC$U0)31jm?-0sIgmYiXECU^cMY;gMwB&W~K
z1H(8CSAwR4AWntztqh|*ZJ-352?Awt5x3xlInjXt7{X1$Oe?qx8pR~<Qo40Ioa3lR
z<#K`CO@$KE(Jh{&_i6i?Cq3;zueE?RGHxaJGNrAkkfPRhP>y!D1E;3e?ei}QCt_hk
zByI3}+Wf+o?Z9(X{D-l1X!0CbA~c-?mvQ0#1E5<ey@<h!*pTY1IKqT5WQJ}iKjx9;
zne>qc&Dh{9l@bLO)!T+T(T#72`Nte^6xLf3eQ4?e@mAicZgUKKjFrajNHT7$HV*Wm
z@MWR}rJS%F1l<;dobXdvW3P*&Mi)FsZe5>VW31%ey_LKnFbAz<;XarSrnZaRoI+n*
zdd%C`d*Xv=qFRL3MbdUr1!~c4CB6W?KL+$@wF{Ckl@7$v%rZD8+0fZqYvl33JhWpu
zJPp0Qwf(4Q04zmb1q`B-)5Nku6>Olzl4CxC8_kY7q#lO}bfO7rk$x4_AjK+pyX-kR
zaJa0Z94N&u65tvkw}ERS5zhkjc`a1P4)0LUHOaI(UU<6>)<g8ed7>O0B5?)3eiM{i
zT@DB9vWv2sYg{Q=peTRxiaS>b&8ugW{P?#dvUI?&Q78nJ=;H=BSM#jOIjmOUdIR)~
zfgg*!S&f-3Lf)U@0l)zYb^i)WYi8eTHCNjlRW`dL=!!(xNZc8VIkt30o#u$y6=frg
z%NmVY%`v9a%p`5;ZikDtI8*GPWgBX~1$A^mT4$38n|^@;0j|;mqT;QgQRF@>rk?`}
k2kyf?YFu(&D(R*1I`oN3qBs8E<rG8=Eh!gn(ULOrzYyR7)Bpeg

delta 1444
zcmZuxZ)_7~7{9ysZEtPYU0bLHrqY!`EbYwo+O^j%bE~BbjQwG(f3TCZx3-IA|GKqf
zZi}!R+a%$GYfAQnnD8f(@IgVK!Ha;=1T-eb1^B=x&F~vW%`owkM)cZ2Am}B}n<w|X
z-}8Ik_kDghJ8PVsH7?ca_YnjUlA~1)k{~c$usg|pR}$wL<j3cVwC-4`U^d~>xs6E;
z@+;*xW=F|qZc`S|>b4bUcW6tOcJx}cG(jMgBT!EJr+T1N(4|o+*V|6Q**vO-#JAL|
z(8^<_awzuJw8aiJSE&ZDd$9p(uTz8Y%}t7dvtLk6(86OH9~cZBf}fi46wEkryvWAt
z;KG*_qjvFJtnZ*KR2Jw*rGeN<gy)e)UwV9S8>d=e0?bFuDdtp3-}<noXgJf;F7Jtv
z<LP5SRx+M`H=iCK5r+H|`FC>K4ai20Obn;TGs$=+6+fIwPij=iM3xgy{WNo^j$J$>
zT|7gESf#R^*hHp)zC&7=56Be$8{fve&~@aaZp&@iNy?fkjw)V;2lq&=dX7udCX<Pr
z4@mjD<W7>bO26GB7ZH|QvK9-v?UYq0fBk;pJ}DLMQ`xB|8QDxt6U=<g<C?h|opwp9
ztX{0vX}Z*(tLs%`RVDgY`ZVoVt|<OdjNreph!L8h9#YffnylYP9u?!_X4<%Yd(|;T
zc^C0~dN>;ow(+ih?)f~hKj;qy&5=F9s5$Wr5bK_>=Ty(wY$miTEYeR9G5ib}3@1B;
z<T`yl-|;_%*O7$T-)rs-b_4?<^G>+ihu)B;_oF|kEuvO5&_?-~#F=vCa&VP}fN%s&
zZV~s2`U*Z*!OD=MvJmif54t9;M9?n?i+YiUkHaXfu*666S$OXNss%QJv~<f1ZM4})
zi1wj+l7N{$<k2UET>iC0CY3M?Idfhf3h7oK3Z4Y<5wc5Nm(dMUTKgTD-l)1o;9JCG
z%_aG^GSVcA{TS|yBaM35r_$T1jHU}Su*rp+V09Ok<zm=SY>n2zk==M3?3+g}_^Jap
ztj~2W<jTU`@2J{kH(tPzp3dFy$!FA&3aIP!L<1JPWkeWGTYQ#@aY)>t_CwZ#>yc;3
z3*f<@;$BzxD75qVvNAH&HD$3E{bTmBjh2-ik>NLA^wrUIRd4=q779L@KIn{26(5BI
z@IXtx0v|4-trb(^DSmJgzHh>dxU17Y3h|rN)phE)+YyE83Df}H8XSAhp_xp0qU=z>
z1Kc4NbW1n`r@OEbwzgnBXj<@tien8<uIyN?Jkk_ipwuqBAdl!J1lI#tQyUh;1R;j?
z&COyop6yS@Io|EzUCu_9gP#NVy!ylmyKaM3Wi%~GD*@bw%Mz=|%Q|4T8^1((cxh!1
z4lbhm)!ijM>#c_FAMo)wrfFMqr_I(}sp)ibPTuWyI=vjrxf)n+1IL>kywBnFx!kY2
z8XIG5QgA0z10Js+^n3Vz-orbbseZwkY7~-!GwsN*oZB(xXdD_~2fZ#9dRFm9!++~Y
zZ~urT3SD6)<loO;281=diFtu59bdyobtJl0r5IxjZJp!`EiN+(795PCURq@ob?m>q
C!mR=T