Chunking File Uploads

A small ColdFusion site that uploads large files in 1 MB chunks with Plupload, then reassembles them on the server.

Live demo: https://www.trinthlo.com/sites/chunking

What it does

• You drag files onto the upload area or click it to browse. Uploads start right away and show their progress.
• Plupload splits each file into chunks of about 1,000 KB and sends them one at a time, retrying a failed chunk up to 3 times. Files smaller than one chunk are sent in a single request.
• upload.cfm adds each chunk to the end of a partial file in ColdFusion's temp folder. When the last chunk arrives, it sends back the file's size and SHA-256 checksum, and the page shows them. You can compare them with the original to confirm the file arrived intact.
• Finished files are deleted by default, which is what the public demo does. To keep them, see Keeping uploaded files.

Limits and safety

Because anyone can upload to a public demo, upload.cfm doesn't trust anything the browser sends:

• Partial files are kept in ColdFusion's temp folder, outside the web root, so an uploaded file can never be requested or run as a page.
• Partial files are named from a hash of the visitor's session and Plupload's file id. The uploaded file name is never used in a path, so names like ../../index.cfm can't write anywhere else.
• Chunk numbers must be valid whole numbers, and a chunk after the first is only accepted if that upload was already started.
• Files over 50 MB are refused, in the browser and again on the server. Change application.maxUploadSize in Application.cfc to allow larger files.
• Partial files from uploads that were never finished are deleted after an hour.

Errors come back as JSON with an HTTP 400 status, and the page shows them.

Keeping uploaded files

Set application.uploadFolder in Application.cfc to a folder outside the web root, for example C:/uploads. Finished files are moved there and given a unique name that keeps the original extension (letters and numbers only). Then change handlePluploadFileUploaded() in index.cfm to do what your application needs once a file is uploaded.

Requirements

• Adobe ColdFusion 2016 or later. It may also run on Lucee, but that hasn't been tested.
• HTTPS. The site redirects every http request to application.urls.secure.
• A browser with HTML5 file upload support. All current browsers have it.

Setup

1. Put the folder in your web root, for example https://localhost/chunking.
2. In Application.cfc, inside onApplicationStart, change application.urls.normal and application.urls.secure to the address where the site will run (for example https://localhost/chunking). If you skip this step, the https redirect and the page's CSS, JavaScript and images still point to the Trinthlo demo site.
3. Open index.cfm in a browser. If you opened the site before changing the URLs, restart ColdFusion first so the new values are loaded.

Project structure

Application.cfc   App settings (upload size limit and upload folder) and SSL redirect
index.cfm         Upload area and Plupload setup
upload.cfm        Receives chunks, reassembles files and returns JSON
layout.cfm        Page layout and footer
assets/           Bootstrap, jQuery, Plupload, site CSS and images

License

MIT, see LICENSE. This covers the code in this repository.

Plupload 3.1.2 (assets/js/plupload.full.min.js) is included unchanged and keeps its own license, AGPLv3 for Plupload and GPL for the mOxie library bundled with it. Its license notices are at the top of the file. See https://www.plupload.com/license for details, including commercial licensing.