TinyWebGallery Flash Uploader

Howto / FAQ

1. The Flash does not work.

This is the main question and there are several things that could be the reason.

You don't have Flash 8 or 9 installed. You can check your version by right clicking on any flash!
Clean the cache of your browser! Click a couple of time reload before you continue! Retry!
If you get an "undefined" right next to the TWG Flash uploader or you get that the configuration cannot be found. The flash needs to call the files in the tfu folder!
Check if you can call tfu_config.php directly (since 2.7.5 tfu_login.php) (in TWG admin/tfu_config.php, in JFU: administrator/components/com_joomla_flash_uploader/tfu/tfu_config.php). Normally there a small info should be displayed. If this is not the case one of the following problems could be
1. Check if the file is there - if not - upload again!
2. You don't have access to this folder or too little restrictions are used! - check if the permissions are right. Some servers to NOT allow 777 on php files (this is not needed). Try 775 or 755 instead! Check the log file - e.g. "error: directory is writable by others" is one of the possible errors. Or e.g. some files have only 600 as permissions. 755 is a very good value most of the time.
3. You have a .htaccess somewhere that restricts that the files can be called. check this by calling tfu_config.php (since 2.7.5 tfu_login.php) and tfu_file.php directly.
4. If this is not the problem you maybe have the Apache module suhosin active. If this is the case you have to set suhosin.session.encrypt=off. Otherwise the session id is encrypted. TFU is internally using a different parameter for the session because there are already many servers that remove session id's from url's to prevent session riding. And the flash needs to pass the session to tfu_upload.php because this is not done automatically by flash!
5. If you have an php error displayed here you might shoud upload the files again or check any modifiction you made in the php files!
6. TFU can make a session workaround! If TFU detects a session problem it creates a folder called session_cache and does the session handling internally. If you still cannot upload and the directory is not created please create it manually and set the permissions to 777! Then upload a file and pray ;).
Check if you have a file called tfu.log - errors are written in there if you don't have parse errors! you can write debug information to this file by using debug("your message"); in any of the php's. I write e.g. error messages if no proper gd lib is installed, an image cannot be processed ... (if you use the Flash in the TWG Admin the log file is the default log file of TWG - counter/_mydebug.log)
The flash reports a http error 403/406 after the upload you should copy the provided .htaccess file to the tfu folder. Some servers handle the requests from the flash not how they should. You can force them to do it the right way by extracting the content of the htaccess.zip = the file .htaccess to the directory of the flash!
The following 2 lines are in the .htaccess:
SecFilterEngine Off
SecFilterScanPOST Off
Flash has a (known but not yet fixed) bug in the Upload header that causes this error if mod_security is enabled! The .htaccess file does disable this. This is not allowed on all systems. If this is the case you have to ask your hoster to do this for you. If they don't you cannot upload files with TFU (or any other flash solution!).
Http error 500 can have several causes. It could be the problem described at 3.2 or at 5. Check this first. Check the tfu.log (see 4.) and the server log for errors. 500 means that there is an internal server error. The server log should help here.
You get an io error: Sometimes this is a caching problem. Most of the time it helps to delete the browser cache and then to restart the browser. I only had this problem with Firefox once in a while. Try IE too because I never had this error with this browser ;).
This problem does happen sometimes too if you have e.g. Norton Internet Security or other Spyware/Script stopping software. They seem to filter requests that come from flash. Disable the software and retry.
HTTP 413 error: This is a really tricky one. This comes if apache does limit the upload. And this cannot be set by php.ini (see howto 14)! Ask your hoster to set the value of LimitRequestBody to a higher value!
If it still does not work you should read this article
contact me ;).

2. How to configure the flash to work with HTTPS or if you get a 404 all the time!

First: The Flash does not work on all servers! I have found out that a valid certificate has to be installed on the server! If this is not the case you can still try but on my test systems where this was the case I didn't got it to work! Do always test on the server where you want to use TFU - don't test e.g. only at home - then it works but than later on the server you want to use it it doesn't.

Then lets configure the flash ;). Install the flash on a server and access it with HTTPS. First use Firefox and try to upload a file! If this does not work please check the certificate. If you don't get it to work with Firefox - sorry - no https possible.

But normally the problem is a IE problem only. The php classes are already patched to work with https :). The problem is that IE does not start the upload when only tfu_upload.php is called within the flash because it uses a wrong port with ie! Therefore you have to open twg_config.php and search for:

$upload_file= "tfu_upload.php";

You have now to add here the full path to the tfu_upload.php with the https port! e.g.

$upload_file= "https://www.tinywebgallery.com:443/path/tfu_upload.php";

If it works - have fun using TWG Flash Uploader.

404 Error: On some servers you get a 404 when you upload. This means that the tfu_upload.php can not be found. First try to call it directly. If this works you can add the full path to the file like shown above and retry.

3. Some functions like 'create folder' do not work.

Most likely safemode is enabled on your system. The Uploader tries to detect this as good as possible. If this is the case I recommend to disable the browsing functionality of the flash. You can try to modify the safemode detection in the tfu_helper.php if you think the flash has the rights e.g. to create folder. create folders is btw. even disabled if a folder could be created but no files can be stored in there!

If the resize box is missing although it is enabled in the config most likely the gd lib is not installed or not at least version 2.0 - check the tfu.log for details!

4. I cannot upload large files because the upload limit does not allow this!

There are some limits when you upload files. If you have the unregistered version you can only have 3 MB in the upload queue. This is the only limitation of the freeware flash. If you use the registered version and the flash says still something like - Upload maximum file size (per file): 2048 k. Then this settings are because of your limitations of your php installation. The uploader checks the limitations and sends them to the flash. There are two settings you can change to increase this limits in php.ini (see howto 14):

upload_max_filesize
post_max_size

Set this limits to the maximum file size you want to allow to upload (or ask your hoster to do his if you don't have access to the php.ini (see howto 14)). There are maybe other restrictions like timeouts you should maybe test. I have successfully uploaded an over 800 MB file on my system. It takes quite long because after the upload php copies the file from the temp dir to the real dir. Sometimes big upload do not work because there are file size limits on the server - ask your hoster if there is something like that. If you find out any special settings you changed to make the flash made working on the system - please let me know - I'll add this info to the FAQ.

If you get errors (most of the time IO errors) during the upload although you have increased the upload limits it's possible that your

max_input_time
max_execution_time
default_socket_timeout

are not set high enough. The times have to be higher than the maxumum upload time you want to allow. Be aware that other user might have slower connections too! If you change the settings and nothing happens it is on some server needed to restart them.

This settings can be set by a .htaccess file on some systems as well. If you still have restrictions please check if this settings are set like this. Depending on the server configuration it is possible to set this variables with .htaccess too! But you have to try if this works for you. The flash tells you at the startup what's your limit!

Resize problem

The normal upload works fine but if you want to resize images the upload fails. If you have this problem your php memory is to low. You cna solve this by:

Increasing the php memory limit. This can be done by changing the vale memory_limit in php.ini (see howto 14). If you call tfu_config.php then the memory limit is shown and the maximum resolution which can be processed
Using image magick. You have to have image magic installed on your server. If you have TWG installed on your server as well you can check this by calling info.php. I'll add this info to TFU 2.8 soon.
You can enable it by setting $use_image_magic=true in the tfu_config.php. TFU uses the command line version if image magick. $image_magic_path defines the path to the convert command. Either specify the full path or put convert to the path. Ask your hoster if you don't know if it is installed.

5. Can I use a .htaccess file (basic authentication) to protect the web page where the flash is?

The answer is: not really - Because it is not nice because the user is asked twice for it's password. The first time it is asked when you access the page and the 2nd time when you upload a file (and you are asked after the file is uploaded - then you have to upload enter username/password and then the upload starts again). And this is only tested for windows - I don't know how e.g. a Mac handles this!
I recommend to use the login of the flash itself. It is much nicer and more powerful because you can assign a directory for the user and you can give the user certain rights - check the .htusers.php and set $login="auth" in the tfu_config.php.

With IE this does work but with Firefox the 1st file you upload is corrupt - Therefore you would have to upload this file twice. Maybe I implement a workaround in the next version version of TFU where I upload the first file twice. But a user friendly website should use a better login method than the basic authentication of apache ;).

6. How to enable thumb caching of the Flash.

By default the preview image you see on the flash are all generated on the fly. This is not very fast but most users don't need fast previews. If you want fast previews you can enable that a preview image is generated after each upload and if a preview is needed the image from the cache is used.
Simply create a folder named "thumbs" in the directory of the flash. Change the permissions of this folder to 777 - done.
The cache is automatically cleaned up. If a filed was not touched for 10 days then the file is removed.

7. How to delete a directory with the Flash?

Deleting a folder is not obvious. You simply have to be in the directory you want to delete. If you have the rights to do this you get the "delete directory" option in the menu. After deleting a directory you are taken to the parent dir. The root dir cannot be deleted!

8. How to use the flash if not all files are in one directory?

The default installation is having all files (including the calling page - by default: tfu.htm) in one directory. In a little bigger system you many want to have e.g. all tfu files in one sub directory and include the flash in your own application. I make a small example how the configuration should look like. You have to use at least TFU 2.5 RC3 that the example below works!

Lets assume you have all your tfu files in the folder /plugins/tfu, your page that includes the flash is in / and the folder you want to upload is /upload.
The tfu_config.php (since 2.7.5 tfu_login.php) has always to be in the directory where the calling page is - in this example this would be /.
You can only change this if you change this in the source code. I have hard coded this because of security reasons (Not good if a caller can maybe use his own config file!)
Adapt the path to the swfobject.js in the page you include tfu - in our example: plugins/tfu/swfobject.js.
To find the xml language files you have to set the 'base' parameter at the flash. This is needed here because language files are loaded before the config is even loaded. - in this example you would have to add ?base=plugins/tfu/.
Set the $install_path in tfu_config.php (since 2.7.5 tfu_login.php) to the path where the tfu files are located - in this example: $install_path="plugin/tfu/"; This is important that the helper, users, license file, and the other tfu_*.php are found.
Finally you have to set the path of the upload dir relative to the tfu folder! In this example you have to set $folder = "../../upload"; in tfu_config.php.
If you you registered tfu copy the license file to the directory where the flash is - in this example: plugin/tfu/

Test:
Put an image in your upload dir. Then you see if the flash can read your remote directory properly. If not please check the paths. Then select an image - a preview has to be shown. Then upload a file. If this three steps work the flash is working. If no directories can be created check the permissions. TFU writes errors to a file called tfu.log in the directory where the tfu_helper.php is located.

9. How to change the colors of the flash - professional license or above?

If you have a professional license or above you can change the colors of the flash. It's not possible to change everything (e.g. the colors of the buttons are defined in a theme and there you can only set 3 different ones. If you like to modify these to you need to modify the source code by yourself) but most colors can be changed. If you have a source code license you can either change the colors by yourself but of course use this settings too. You only have to remove the body of the method MLayout.as -> resetColors. If your license does already contain TWG_SOURCE in the domain this is not needed.

Colors does always have to be in the hexadecimal format. e.g. AA00FF unless something else is described. This are the possible colors you can change:

c_theme - The basic theme of the flash - possible settings are "haloOrange", "haloGreen", "haloBlue"
c_text - The basic color of all texts
c_text_header - The color of the header text (for popups too!)
c_header_bg - The background of the header
c_header_bg_2 - The 2.nd background of the header - makes a gradient fill from c_header_bg to c_header_bg_2.
c_bg - The main background
c_border - The color of the border
c_list_bg - The background of the list and the grid
c_list_header - The background color of the header of the grid
c_progress_text - The color of the text on the progress bar
c_progress_label - The color of the label left to the progress bar
c_progress_bar - The color of the moving part of the progress bar
c_progress_bar_bg - The color of the background of the progress bar
c_progress_bar_seperator - The color of the small seperators in the progress bar
c_popup_bg - The background color of popups like the login
c_popup_header_bg - The background of the headers of the popups
c_popup_header_bg_2 - The 2.nd background of the headers of the popups - makes a gradient fill from c_popup_header_bg to c_popup_header_bg_2
c_popup_border - The color of the border of the popups
c_bg_numbers - The background of the line numbers - This color is related to the backgound color but with an alpha channel - you have to find the right color e.g. with a tool that shows you the color of the background when faded.
c_numbers - The color of the numbers

To set a color you simly add e.g. so.addVariable("c_text", "FF00FF"); to the javascript call or as a parameter to the flash. You see two examples in the source code of this page (as comments). If you don't have a professional license or above and set colors this way then all colors are set to white.

10. How to enable support for chinese filesnames?

By default TFU does not support chinese (or japanese) files names. I do actually write the filenames to the disk but on many systems they are written as e.g. ????.jpg. To fix this the filenames have to be encoded to e.g. Big5 for chinese.

To enable this you have to open tfu_helper.php and set $fix_utf8 to Big5. You can actually set it to utf-8 but then ony my system all files do work in flash and with php but with the ftp program not all files could be deleted (with php it could!). You have to try by yourself because I don't know your system ;).

11. Fullscreen preview of images does not work properly.

You forgot to add

so.addParam("scale","noScale");
so.addParam("allowfullscreen","true");

when including the flash. Check the code above how to include the flash.

12. "Uploaderundefined" is the status bar.

After uploading you get the error message "Uploaderundefined" in the title bar of TFU. The reason is a session loss in tfu_uplad.php. From 1.7 on TFU can detect this and tries to make an internal session handling. This is done by creating a directoy "session_cache" in the tfu folder. This is done automatically. But if TFU does not has the rights to do this you have to create this folder manually and set the permissions to 777. TFU does then store the data in this folder and does the cleanup as well (old files are removed after 1 day!).

You can check if you have this problem you can check the tfu.log file. There you find a message.

13. Howto use the flash standalone version in a secure way!

Important - only for the standalone version!

First of all you should update to at least TFU 2.7.1! Some checks where only made in the flash and not on the server side. Since 2.7.1 every possible input parameter is checked and validated the same way the flash does.

But you still have to integrate the flash properly into your environment to have a secure setup. Basically there are 2 usages of the flash:

Completely standalone with the build in login mechanism:
If you use this way then $login is set to "auth" and you don't have a problem because the check if the login is o.k. is done properly. Calling e.g. the tfu_upload.php does not work because the user is not logged in!
Integrated into any kind of website that has any kind of login mechanism (CMS, simple page with login form ...) :
Lets asume the following scenario: You have a website where you have a protected area and you want to integrate the flash there. You use a login to get to this site and have $login="true" set in tfu_config.php. You think this should be enough because no one can call the flash! This is not true at all! If anyone knows the location of the uploader he can directly call the flash and even upload files directly by sending faked request like the flash does! You have only made the site where the flash is in secure - not the flash itself!
The solution is very simple! You have to check if this user that calles the flash is authorized! You have to check your system if the login was made properly and set this in tfu_config.php (since 2.7.5 tfu_login.php).
The simplest way is:
1. Set a session variable after you have sucessfully logged in into your main website (This is normally done anyway).
2. Get this variable in tfu_config.php (since 2.7.5 tfu_login.php) with $_SESSION['<your variable>'] and add this check to the line where you find isset($_POST["twg_user"]).
  By default this line looks like:
  if ( isset($_POST["twg_user"]) && isset($_POST["twg_pass"])){
  Afterwards something like:
  if ( isset($_POST["twg_user"]) && isset($_POST["twg_pass"]) && isset($_SESSION['<your variable>'])){
  
  You can of course do more than simply checking if the variable exists. You can e.g. get this variable and check in your db is it is o.k. It's up to you and your existing system how you solve it! Only be aware that you have to do something!

If you have the flash accessible for everyone make sure that ony the file extensions that cannot harm you can be uploaded. Since 1.7.1 this extensions are checked in the flash AND on the server side again. If you use the flash like this you have to update!

TWG and JFU are checking the internal login already! Therefore you don't have a problem there! I still stongly recommend an update to the latest version (TWG 1.7.1 and JFU 2.7.1) because you still have the issue that not all parameters are checked and users that are authorized can fake requests! The minimum you should do is not allow users to rename files!
I'll provide update files for TWG which makes updating much easier on the download page!

14. Where to find php.ini

The php.ini is your php configuration file of your server. It's not part of TFU/JFU and you have to make changes here to increase some limits I have explained already e.g. in howto 4. There are several locations where the php.ini files is/can be.

Private hosting: In the config directory of your web server. For apache this is e.g. in the apache\bin folder. The locations below should work too.
Shared hosting: If you are on shared hosting you normally cannot change the php.ini directly. But most hosters allow to have a custom php.ini in the root directory or even in a sub directory. Therefore you should try to place your php.ini in the root folder and/or the tfu folder (JFU: administrator/components/com_joomla_flash_uploader/tfu/).
If this does not work you have to ask your hoster!