File Validation Rules not working anymore

[jesperbeisner]

Laravel Version

13.25.0

PHP Version

8.5.9

Database Driver & Version

No response

Description

We have this Laravel rule:

    /**
     * @return array<string, array<int, string|File>>
     */
    public function rules(): array
    {
        return [
            'filepond_files' => ['required', 'array'],
            'filepond_files.*' => ['required', File::types(['pdf', 'png', 'jpg'])->min('1kb')->max('5mb')],
        ];
    }

and it was and is working fine in Laravel v13.24.0 but broke with v13.25.0 🤔
Have not checked yet which commit broke it, but we get the validation errors now, that no file was uploaded when everything is there.

Steps To Reproduce

Use the rule as provided and try to upload a file.

[crynobone]

Hey there, thanks for reporting this issue.

We'll need more info and/or code to debug this further. Can you please create a repository with the command below, commit the code that reproduces the issue as one separate commit on the main/master branch and share the repository here?

Please make sure that you have the latest version of the Laravel installer in order to run this command. Please also make sure you have both Git & the GitHub CLI tool properly set up.

laravel new bug-report --github="--public"

Do not amend and create a separate commit with your custom changes. After you've posted the repository, we'll try to reproduce the issue.

Thanks!

[jfbiswajit]

Reproduced. This is not the File rule. Nothing under src/Illuminate/Validation/ changed between v13.24.0 and v13.25.0.

Request::all() flipped its merge order in #61099 (8df67f9d), so text input now overwrites uploaded files on a shared key. FormRequest::validationData() returns $this->all(), so the validator stops seeing the file.

Failing test, drops straight into tests/Http/HttpRequestTest.php:

public function testAllKeepsUploadedFilesWhenTextInputSharesTheKey()
{
    $file = new SymfonyUploadedFile(__FILE__, 'doc.pdf');

    $request = Request::create('/', 'POST',
        ['documents' => ['']],
        [], ['documents' => [$file]],
    );

    $this->assertInstanceOf(UploadedFile::class, $request->file('documents.0'));
    $this->assertInstanceOf(UploadedFile::class, $request->all()['documents'][0]);
}

v13.24.0: passes. v13.25.0 and v13.26.1: second assertion fails, all()['documents'][0] is ''. The first assertion passing on every version shows the upload is present and parsed, just dropped by all().

#61221 restored key ordering but still applies input last, so the precedence is unchanged:

$input = array_replace_recursive($input, $this->allFiles(), $input);

The tests added in #61099 only assert on $request->email and $request['email'], but the change was made in all(). If the intent was to stop a client turning a scalar field into an UploadedFile, __get() / offsetGet() would cover that without touching validation input. Happy to open a PR on those lines if that matches the intent.

Workaround:

protected function validationData(): array
{
    return array_replace_recursive($this->input(), $this->allFiles());
}

@jesperbeisner check whether your frontend posts a text value under filepond_files alongside the files: dd($request->post('filepond_files'), $request->file('filepond_files'));. If it does, the workaround above unblocks you.

[calebdw]

Just ran into this bug today, our prod endpoint is dead-in-the-water until this gets fixed or I implement a workaround

Edit: I suppose the proper fix is for the client to stop sending files as filenames in the request parameters