[Resolved] File upload field does not update URL

[Author]

Posts

[matthewS-9]

I am trying to:
- I use a file upload field to upload a file for a custom post type (for example a Passport document of an Application).
- I submitted an Application with Passport 1 using a CRED creation form.
- Then I edited the Application with Passport 2 using a CRED edit form.
- I then retrieved the attachments with below code in cred_submit_complete:

    global $wpdb;
    $protected_url = '';
    $attachment_ids = $wpdb->get_col("SELECT ID FROM {$wpdb->posts} WHERE post_parent = $post_id AND post_type = 'attachment'");
    foreach ( $attachment_ids as $attachment_id ) {
    }  

Both Passport 1 and Passport 2 are returned.

Link to a page where the issue can be seen:
- NA.

I expected to see:
- Passport 1 is removed.

Instead, I got:
- Both Passport 1 and Passport 2 are returned.

I found this: https://toolset.com/forums/topic/proper-post-attachment-management-via-cred/
If we have to delete Passport 1 manually in EDIT form then please provide the hook for the action.

[Beda]

You're right, the Attachment Data is not removed, but should when we add new media to the post.
We clearly remove the old media in the form and add new media, so the old media - while it has to stay in the Media Library, must be removed as an attachment, from that post, unless of course the media is used elsewhere in this same post.

I'll escalate that, in order to address it.
It happens as well in the backend and is a generic problem of attachments in Toolset, as I saw during testing.

[Beda]

That was my bad, we figured out that it is WordPress' native behaviour to not remove the attachment post in the posts database table when you remove a Featured Image (or else) from a Post.
Only fully deleting the post will remove the post_parent entry from the attachment post row, but not delete that either (just disconnect it)

Toolset follows the same hooks as WordPress offers here and hence has the precise same behaviour.
To change that it would have to be changed in WordPress Core since the core works exactly the same way.

What I suggest to have a solid solution, rather than adding custom code to remove the post_parent entry in the attachment post row, is to retrieve the data with another approach
You want the value of a Toolset Field, hence you can work with the WordPress API to get that value.

Could you explain the precise goal you have?
If I know what you want to achieve with the data, I can show how to retrieve it, for example, using get_post_meta:
https://developer.wordpress.org/reference/functions/get_post_meta/

This will always only return the actual value you have in the field, hence the "latest" value added, if you do this in a cred_submit_complete

[matthewS-9]

Our goal is to allow users to upload and edit their SENSITIVE document via Toolset upload field in a Toolset form.
A typical use case is as follow:
- Step 1: A user submits an Application (that is a custom post type) with Passport 1 (that is a single upload field) using a CRED creation form.
- Step 2: The user then edits their Application with Passport 2 using a CRED edit form.
- Step 3: An external tool retrieves the uploaded file using the Application Id (the post_id) right after the file is uploaded by Toolset form for protecting the sensitive information. Only Passport 2 should be returned.

[Beda]

I understand.

It is WordPress Core behaviour to NOT delete that attachment entry in the posts table and hence Toolset cannot help solve this.
If your 3rd party app gets those attachments by the parent_post, it's doing it wrong because the corer of WordPress will always, no matter if you use Toolset or not, return ALL the attachment posts ever made to that post.

You should instead grab the data that is "unique", which is in the case of an Image Field, the postmeta value and Post ID assigned to.
You'd need to use get_post_meta, where the value will change and point to the particular file in question.

There is no other way to manage this, it would be the same with WordPress core-only features.

[matthewS-9]

Thanks, Beda.

If WordPress does not delete that attachment entry in the posts table then is there any way to remove the "Delete" icon of Toolset field in Toolset EDIT form (please review the attached image) and show the upload control when the EDIT form is loaded so that it does not confuse users?

[Beda]

You could always use the Form setting "Use the WordPress Media Library manager for image, video, audio, or file fields"-
That will produce a different upload experience to the user (but note, it can't be used with Guests roles).

This will add a different upload button and let the user use the WP Media Uploader.
Media access itself, on the other hand, can be controlled by Toolset Access > Forms > Media Settings

Or, you can hide that "X" with some custom CSS, but that will likely not be the desired solution as the user won't be able to add new data.

I'd suggest, if you keep the current setup, to amend the 3rd party script. This will solve both problems:
the user confusion is resolved, and the data is pulled correctly.

[matthewS-9]

My issue is resolved now. Thank you!