PolyCMS Media Library Guide

Overview

The PolyCMS Media Library provides centralized image and file management for all CMS content. All uploads are stored in uploads/polycms/, keeping CMS media completely separate from your Perfex CRM files.

Upload Methods

Drag-and-Drop Upload

Drag files directly onto the Media Library window to upload. Multiple files can be uploaded simultaneously.

Browse Upload

Click the Upload button to open a standard file picker dialog. Select one or multiple files for upload.

In-Editor Upload

When editing a post or page, insert images directly from the TinyMCE editor. The Media Library modal opens inline, allowing you to select existing media or upload new files.

Directory Structure

PolyCMS organizes uploads using an automated Year/Month/Day directory structure:

uploads/polycms/
├── 2026/
│   ├── 05/
│   │   ├── 15/
│   │   │   ├── hero-banner.jpg
│   │   │   └── hero-banner-thumb.jpg
│   │   └── 16/
│   └── 06/

This structure prevents filename conflicts and keeps directories manageable even with thousands of files.

View Modes

Toggle between two display modes:

Media Features

• Directory Tree Browser — Navigate the folder structure using the sidebar tree.
• File Type Filtering — Filter by Images, Documents, or All Files.
• Lightbox Preview — Click any image to view full-size preview without leaving the library.
• Image Thumbnails — Auto-generated thumbnails for all uploaded images.
• File Details — View filename, dimensions, file size, upload date, and URL for each file.

6-Layer Upload Security

PolyCMS implements enterprise-grade server-side security for all file uploads:

1. File Extension Validation — Only whitelisted extensions are accepted (jpg, png, gif, webp, svg, pdf, etc.). Executable files (.php, .exe, .sh) are blocked.
2. MIME-Type Verification — The actual file content is inspected to verify it matches the declared extension, preventing renamed malicious files.
3. Magic Bytes Verification — Binary file headers are checked to confirm the true file format.
4. Content Scanning — Uploaded files are scanned for embedded PHP code, script tags, and other potentially dangerous content to prevent Remote Code Execution (RCE).
5. Double-Extension Blocking — Filenames like image.php.jpg are rejected.
6. GD Image Reprocessing — Images are reprocessed through PHP GD library to strip any embedded payloads while preserving visual quality.

Safe Deletion

When deleting a media file, PolyCMS checks if the file is currently referenced by any post or page content. If the file is in use, you receive a warning before deletion to prevent broken images on your frontend.

Storage Path

All CMS media is stored under:

{perfex_crm_root}/uploads/polycms/

This dedicated directory ensures CMS uploads never interfere with Perfex CRM client files, proposals, or other module uploads.

Database-Backed Media Tracking (v1.1.0)

Starting from v1.1.0, all uploaded media are tracked in the blog_media database table. Each record stores:

Posts and Pages link to media via feature_image_id, while retaining the feature_image path for fast rendering. When media is deleted, all references are automatically cascade-cleared.

Related Documentation

• Managing Posts — Insert media into post content.
• Managing Pages — Add images to static pages.
• Building a Custom Theme — Access media in theme templates.
• REST API Guide — Programmatic media upload, listing, and deletion via API.
• API Explorer — Test media API endpoints interactively.