Media Library

Unfold CMS includes a built-in media library for managing images, documents, and other files. The media library supports drag-and-drop uploads, file security validation, and integration with the Unsplash stock photo library (Pro).

Uploading Files

Drag and Drop

The media library supports drag-and-drop uploading. Drag files from your computer onto the upload area in the admin panel. Multiple files can be uploaded simultaneously.

Upload Limits

Configure upload limits and allowed file types in Settings > Media in the admin panel.

Note: Your server's upload_max_filesize and post_max_size PHP settings must also accommodate the desired file size. The CMS respects whichever limit is lower.

Allowed File Types

By default, the following file types are accepted:

You can customize allowed extensions through the admin settings.

File Security

The media library includes comprehensive upload security:

• Extension validation — Only allowed file types are accepted
• MIME type checking — File content is verified against its extension
• Dangerous file blocking — PHP files (.php, .phtml), shell scripts, executables (.exe, .phar) are always rejected
• Double extension prevention — Files like image.php.jpg are detected and rejected
• Path traversal protection — Upload paths are sanitized to prevent directory traversal attacks
• Size limit enforcement — Both per-file and total upload limits are enforced
• PHP execution prevention — .htaccess rules prevent PHP execution in the uploads directory

Image Processing

When images are used as featured images on posts, the CMS automatically generates optimized sizes:

All generated sizes include sharpening for crisp display.

Storage Drivers

Local Storage (Default)

The default storage driver stores files on the local filesystem:

'media' => [
    'storage_driver' => 'local',
],

Files are stored in storage/app/public/ and served through the public symlink at /storage/.

Amazon S3

For scalable cloud storage, configure S3 in config/site.php:

'media' => [
    'storage_driver' => 's3',
    's3_key' => env('AWS_ACCESS_KEY_ID'),
    's3_secret' => env('AWS_SECRET_ACCESS_KEY'),
    's3_region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
    's3_bucket' => env('AWS_BUCKET'),
    's3_url' => env('AWS_URL'),
],

Or set these in your .env file:

AWS_ACCESS_KEY_ID=your-key
AWS_SECRET_ACCESS_KEY=your-secret
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=your-bucket
AWS_URL=https://your-bucket.s3.amazonaws.com

Unsplash Integration (Pro)

Pro and Agency editions include integration with Unsplash, providing access to millions of free, high-quality stock photos directly from the media library.

Setup

1. Create an Unsplash developer account at unsplash.com/developers
2. Create a new application to get your Access Key
3. Configure through Settings > Media in the admin panel, or in config/site.php:

'media' => [
    'unsplash_enabled' => false,
    'unsplash_access_key' => '',
],

Usage

Once configured, the media library displays an Unsplash tab where you can:

• Search for photos by keyword
• Browse trending and curated collections
• Preview images before inserting
• Automatically download and store selected images locally

Downloaded images are stored in your media library just like regular uploads, so they continue to work even if Unsplash access is later disabled.

Using Media in Content

Featured Images

Posts and pages support featured images that are used for:

• Post listing cards and thumbnails
• Open Graph social sharing images
• Hero sections on individual post pages
• Related posts displays

In-Content Images

Images can be embedded directly in post content through the editor. The editor supports:

• Uploading new images inline
• Selecting existing images from the media library
• Alt text for accessibility

File Management

The admin media library provides:

• Grid and list views for browsing files
• Search by filename
• Filter by file type
• Delete unused files
• File details — dimensions, size, upload date