About bitrix-files
A Bitrix file-handling skill for developers working with storage, uploads, delivery, and UI uploader workflows. It outlines safe practices for file IDs, validation, private-file access, and deletion.
Key features
- 01Manage file storage through CFile
- 02Validate uploaded files
- 03Handle pending UI uploader files
- 04Serve private files with access checks
Use cases
- 01Save or replace files while retaining IDs
- 02Validate uploads in an application action
- 03Deliver private files only after rights checks
Install
Copy the command and run it in a terminal.
$
npx skills add https:/ / github.com/ bxmaximum/ bitrix-framework-skills --skill bitrix-filesAfter installing, type/bitrix-filesin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
rules/delivery.mdstorage.mdui-uploader.mduploads.mdDetails
From the project READMEBitrix files
Baseline: main 23.0+ · Verified: main 26.800.0, ui 26.687.0
| Task | Read |
|---|---|
Save, read, resize, delete; b_file layout; clouds; replace content keeping the ID | rules/storage.md |
Accept uploads in your action: validation, MIME, legacy main.file.input | rules/uploads.md |
ui.uploader backend: UploaderController, commit pending files | rules/ui-uploader.md |
Serve files: BFile, private files, viewer | rules/delivery.md |
JS widgets (ui.uploader, ui.viewer): bitrix-ui. Uploader settings in .settings.php: bitrix-settings. File fields: bitrix-iblocks, bitrix-highloadblock.
Invariants
- Write
b_fileonly throughCFile.FileTableis read-only:add/update/deletethrowNotImplementedException. Store the file ID, never a path. - For URLs use
CFile::GetFileArray()['SRC']orCFile::GetPath(); for local bytes useCFile::MakeFileArray($id)['tmp_name']. Never glue/upload/+SUBDIRyourself: clouds, theupload_diroption and replacements all break it. - Client name, MIME and size are untrusted: whitelist extensions, detect MIME from content, and decode images.
- Never pass user input to
CFile::MakeFileArray(): it reads local paths, b_file IDs and URLs. - Everything in
/upload/is reachable by URL. Serve private files through an action that checks rights. CFile::Delete()removes the physical file and its resize cache. It cannot be undone.
Comments
Markdown supported