silverstripe-userforms/code/model/editableformfields/EditableFileField.php

<?php

/**
 * Allows a user to add a field that can be used to upload a file.
 *
 * @package userforms
 */

class EditableFileField extends EditableFormField
{

    private static $singular_name = 'File Upload Field';

    private static $plural_names = 'File Fields';

    private static $has_one = array(
        'Folder' => 'Folder' // From CustomFields
    );

    /**
     * Further limit uploadable file extensions in addition to the restrictions
     * imposed by the File.allowed_extensions global configuration.
     * @config
     */
    private static $allowed_extensions_blacklist = array(
        'htm', 'html', 'xhtml', 'swf', 'xml'
    );

    /**
     * @return FieldList
     */
    public function getCMSFields()
    {
        $fields = parent::getCMSFields();

        $fields->addFieldToTab(
            'Root.Main',
            TreeDropdownField::create(
                'FolderID',
                _t('EditableUploadField.SELECTUPLOADFOLDER', 'Select upload folder'),
                'Folder'
            )
        );

        $fields->addFieldToTab("Root.Main", new LiteralField("FileUploadWarning",
                "<p class=\"message notice\">" . _t("UserDefinedForm.FileUploadWarning",
                "Files uploaded through this field could be publicly accessible if the exact URL is known")
                . "</p>"), "Type");

        return $fields;
    }

    public function getFormField()
    {
        $field = FileField::create($this->Name, $this->EscapedTitle)
            ->setFieldHolderTemplate('UserFormsField_holder')
            ->setTemplate('UserFormsFileField');

        $field->setFieldHolderTemplate('UserFormsField_holder')
                ->setTemplate('UserFormsFileField');

        $field->getValidator()->setAllowedExtensions(
            array_diff(
                // filter out '' since this would be a regex problem on JS end
                array_filter(Config::inst()->get('File', 'allowed_extensions')),
                $this->config()->allowed_extensions_blacklist
            )
        );

        $folder = $this->Folder();
        if ($folder && $folder->exists()) {
            $field->setFolderName(
                preg_replace("/^assets\//", "", $folder->Filename)
            );
        }

        $this->doUpdateFormField($field);

        return $field;
    }


    /**
     * Return the value for the database, link to the file is stored as a
     * relation so value for the field can be null.
     *
     * @return string
     */
    public function getValueFromData()
    {
        return null;
    }

    public function getSubmittedFormField()
    {
        return new SubmittedFileField();
    }


    public function migrateSettings($data)
    {
        // Migrate 'Folder' setting to 'FolderID'
        if (isset($data['Folder'])) {
            $this->FolderID = $data['Folder'];
            unset($data['Folder']);
        }

        parent::migrateSettings($data);
    }
}