Overview

Widget Upload

Column widget for file uploading with a dedicated Uploader/Upload tab in the column metadata-editor.

isImageUpload: enables image handling + preview.
isDBUpload: file persistence in the DB.
isMultipleUpload: multiple upload.
IsZippedUpload: zip archive support.
UseRouteNameAsSubfolder: subfolder from route.
UseRecordIDAsSubfolder: subfolder from record id.
DefaultUploadRootPath: upload root path.
allowed_file_types: extension/MIME whitelist.
max_file_size: maximum file size.
createThumb, thumbWidth, thumbHeight: thumbnail management.
customUploadHandlerPath: custom upload endpoint.
upload_secure (Secure upload): the column's files are readable only with a session that can see the column; otherwise they are public. See below.

Snippet 1JSON

{
  "uploader": {
    "beforeUpload": "function(event, field, record){ return true; }"
  },
  "style": {
    "editCss": "min-height: 52px;"
  },

Column	`/upload/...` (files on disk)	`/api/UploadImage` (previews, BLOB)
`upload_secure` off	Public: opens without login, also from emails or external pages	Requires a session
`upload_secure` on	Requires a session that can see the column on the route (`getFlatRecordData` permissions): no login 401, no permission 403	Same rule: no permission on the column 403

The protected folder is the one the column saves into: DefaultUploadRootPath (or the root) plus the route subfolder when UseRouteNameAsSubfolder is on. If a secure column saves into the shared root, the whole root becomes protected: to keep the other files public give the secure column its own folder (DefaultUploadRootPath or UseRouteNameAsSubfolder).
Files already uploaded are not moved: the path is what counts. Changing the flag takes effect within two minutes, immediately after the metadata invalidation.
A direct link to a protected file does not work outside the application (emails, external sites): use files of non-secure columns there.
Guest (enableGuest=true): reads the protected files of the columns it can see, as for the APIs.
Every file is served with X-Content-Type-Options: nosniff; anything that is not an image, pdf, audio or video is downloaded as an attachment with Content-Security-Policy: sandbox, so an uploaded file never runs as an application page.
Extensions rejected at upload, on every part of the name (photo.php.png included): server-side executables and scripts (aspx, php, jsp, exe, dll, ps1, sh, ...) and active content (html, htm, svg, js, swf, ...).

Always use allowed_file_types + max_file_size together for hardening.
With multiple upload, verify MultipleUpload* metadata field mappings.
Upload and /api/UploadImage require login; /upload requires it only for upload_secure columns (see "Access to Uploaded Files"). Download returns only files from the record's folder: of the filename parameter only the file name counts.
Subfolders (UseRouteNameAsSubfolder, UseRecordIDAsSubfolder) and DefaultUploadRootPath are decided by the column metadata read on the server; the values sent by the client count only when the column cannot be resolved (custom handler). The root is uploadFolder if absolute, otherwise <projectDataFolder>/Upload, the same on every provider.