Product Attachment
v1.1.2
Product Attachment
- Updates and support included for 12 months
- License key delivered immediately by email
- 30-day money-back guarantee
- Full documentation included
- Composer-ready installation
Product Attachments
Attach documents to your products and decide, file by file, who is allowed to download them. Datasheets, assembly instructions, certificates, warranty terms, CAD drawings, price lists — upload them straight from the product form, reorder them by drag-and-drop, and let the storefront list them under the product.
Each file is either public or reserved for logged-in customers. That second mode is the reason this module exists: reserved files are stored outside the web root and are only ever served by a controller that checks the visitor first. A guest who guesses or is sent the URL gets a 404, not the file. Modules that keep their uploads in the media folder can only hide the link — the file itself stays one direct URL away.
Who it's for
- B2B merchants publishing technical documentation, certificates or price lists reserved for their trade customers
- Manufacturers and distributors shipping manuals, safety sheets or CAD files alongside every product
- Merchants who must keep some documents behind a login for contractual, regulatory or commercial reasons
- Anyone tired of maintaining product PDFs as CMS blocks or hard-coded links in a template
Key benefits
- Genuinely restricted files — customer-only attachments live outside the web root and are streamed by a controller that checks the visitor. Sharing the URL gains nothing, which is what "reserved for customers" has to mean to be worth anything.
- Per-file visibility — public and restricted documents coexist on the same product. Publish the datasheet, reserve the price list.
- Managed from the product form — a collapsible Attachments section on every product type. Upload, title, reorder by drag-and-drop, delete. No separate admin screen to learn.
- Nothing leaks to guests — the storefront block renders nothing at all when the visitor may see no attachment, so a guest never even learns that reserved documents exist.
- Full Page Cache friendly — the block reads the logged-in state from Magento's HTTP context, which the cache already varies on, and carries the product cache tag so saving a product refreshes it.
- Theme-agnostic — the module ships a block and a template but places neither, so it drops into a Luma layout, a Hyvä theme, or a tab extension such as Swissup Easytabs without fighting your design.
Compatibility
- Magento 2.4.x / Mage-OS equivalent
- PHP 8.1, 8.2, 8.3, 8.4
- No dependency on other Wimakeit modules
- Works with Hyvä and Luma frontends
- Compatible with Varnish Full Page Cache
- Allowed file types: PDF, DOC, DOCX, XLS, XLSX, CSV, TXT, ZIP, JPG, JPEG, PNG
Install this module via Composer. Make sure your auth.json is configured with your Wimakeit credentials.
$ composer require wimakeit/module-product-attachment:^1.1.2
$ bin/magento setup:upgrade
$ bin/magento setup:di:compileInstallation notes
The standard composer require + setup:upgrade + setup:di:compile flow applies. The points below cover what's specific to this module.
Required dependencies
No Wimakeit dependency — this module stands alone. It requires only Magento's own Catalog, Customer, Backend, MediaStorage, Store and Ui modules, which every installation already has.
No admin configuration
The module ships no configuration section. There is nothing to set under Stores → Configuration after installing it: allowed file types and storage location are fixed by design, and visibility is chosen per file on the product itself.
ACL permissions
The module creates no new ACL resource. Uploading attachments is gated on the existing Catalog → Products permission, so any admin role that can already edit products can manage attachments. No role changes are needed after installation.
Where the files are stored
Attachments are written to var/wimakeit/product_attachments/, deliberately outside the web root. This is what makes the "logged-in customers only" setting real: those files have no URL of their own and are streamed by the module's download controller, which checks the visitor first. Storing them under pub/media would leave them reachable by direct URL and reduce the restriction to hiding a link.
Two consequences for your infrastructure:
- Deployment scripts that wipe
var/will delete uploaded attachments. Excludevar/wimakeit/product_attachments/from any cleanup step. var/is not shared between web nodes. On a multi-node setup, mountvar/wimakeit/product_attachments/on shared persistent storage.
Make sure the directory is writable by the PHP user:
mkdir -p var/wimakeit/product_attachments
chown -R www-data:www-data var/wimakeit
The storefront block
Since 1.1.0, nothing to do: the module places itself in product.info.details, group detailed_info — the stock Magento contract for product tabs, honoured by Luma and Hyvä alike. The block is named wimakeit.product.attachments.
Do not add a <referenceBlock> for it. Up to 1.0.x the module shipped unplaced and this page told you to. Doing it now gives you the Documents tab twice.
To move it elsewhere, remove the shipped one first:
<referenceBlock name="wimakeit.product.attachments" remove="true"/>
Same with Swissup Easytabs: remove the shipped block, then create a tab in Content → Easytabs of type Custom Block using the same class and template. One tab per store view if you need a localised title.
The block renders nothing when the visitor may see no attachment, so tab extensions that drop empty tabs will hide the tab by themselves.
The tab does not show up? Your theme decides how detailed_info is rendered, and one that picks its sections positionally will drop this one silently — the module sorts at 20. Check the theme's product-sections template before suspecting the module.
Allowed file types
pdf, doc, docx, xls, xlsx, csv, txt, zip, jpg, jpeg, png. Executable and script types are refused. Uploading is admin-only; there is no frontend upload.
Store scope
Attachments are not store-scoped: one list per product, shown on every store view. If you need per-language documents, that requires adding a store_id column to the wimakeit_product_attachment table.
- Version
- v1.1.2
- Support
- 12 months
- Last updated
- Aug 23, 2026
- Magento
- Magento 2.4.4 Magento 2.4.5 Magento 2.4.6 Magento 2.4.7 Mage-OS 2.0 Mage-OS 2.1
- PHP
- PHP 8.1 PHP 8.2 PHP 8.3
- Hyvä
- Not compatible
- Package
-
wimakeit/module-product-attachment
Compatibility checker
Pick your stack to see if this module fits.
Changelog
Categories: Security, Feature, Fix, Perf, Admin, Deps.
[1.1.2] - 2026-08-18
Fix
- L'onglet « Documents » et six autres libellés s'affichaient en anglais sur les vitrines néerlandaise et espagnole.
- Une vignette qui échoue est désormais tracée dans les journaux, au lieu de disparaître sans explication.
- Le message d'erreur d'un envoi de fichier ne révèle plus de chemins techniques du serveur.
Doc
- Le guide d'installation décrivait encore une pose manuelle du bloc, ce qui aboutissait à deux onglets « Documents » identiques.
[1.1.1] - 2026-08-18
Fix
- Les vignettes des images jointes s'affichaient comme une image cassée dans la fiche produit en admin.
[1.1.0] - 2026-08-18
Feature
- Documents visible sur la fiche produit. Un onglet dédié liste les documents du produit, chacun avec son titre, sa description et son poids — jusqu'ici rien ne s'affichait côté boutique.
- Aperçu visuel. Les images ont une vraie miniature, les autres formats un badge coloré indiquant le type — en back-office comme en vitrine.
- Compteur de téléchargements, avec la date du dernier, visible dans la fiche produit en back-office.
- Visibilité « masqué », pour retirer un document de la vitrine sans le supprimer.
- Description par document, affichée sous son titre.
Fix
- Les documents enregistrés n'apparaissaient plus dans le formulaire produit après rechargement, et étaient perdus à l'enregistrement suivant.
- La table des documents n'était pas créée à l'installation, ce qui rendait l'écran inutilisable.
Security
- Un document masqué reste téléchargeable pour qui connaît son identifiant : corrigé, ainsi que son affichage aux clients connectés.
[1.0.4] - 2026-08-17
Fix
- Packaging. The module no longer ships the development dependencies used to run its own test suite, which could collide with the project's own copies and break code compilation on install.
[1.0.3] - 2026-08-17
Perf
- Unchanged attachments no longer trigger a database write on every product save. Editing a product's price or name issued one pointless UPDATE per attached file; on catalogues with several documents per product this quietly added write load to the most common admin action.
[1.0.2] - 2026-08-17
Security
- Restricted documents could be pointed at arbitrary files on the server. An admin holding only the Catalog > Products permission could make an attachment reference any file under
var/— database backups, logs, customer exports — mark it public, and have it downloaded by anonymous visitors. Attachment paths are now validated and can no longer leave the attachments directory. - Documents of disabled or off-website products stayed downloadable. Attachment ids are sequential, so a document remained reachable by trial and error after its product was taken offline. The download now requires the product to exist, be enabled and belong to the current website.
Fix
- An attachment could be destroyed when replacing its file failed. If storing the new file failed (full disk, permissions), the existing attachment was deleted along with its file instead of being left untouched. A row that cannot be processed is now always preserved.
- Attachment files are removed when a product is deleted. Only the database rows were cleaned up before, leaving the files on disk permanently with nothing left to identify them.
- A failed attachment write no longer interrupts the rest of the save. An error on one row aborted the whole synchronisation and left the product's attachments half-updated.
Perf
- The storefront attachment list is cached again. The block was re-querying the database on every render instead of using its cache entry.
[1.0.1] - 2026-06-08
Fix
- File uploads made reliable across admin form layouts. The uploader failed to pick up the file when the product form posted it under its nested field name, so an upload could silently produce no attachment.
[1.0.0] - 2026-06-08
Feature
- Attach files to any product from the admin product form — PDF, Office documents, images and archives, on every product type, reorderable by drag-and-drop.
- Per-file visibility: public or logged-in customers only. Restricted files are stored outside the web root and served only after the visitor is checked, so sharing the URL gains nothing.
- Storefront listing that reveals nothing to guests — the block renders nothing at all when the visitor may see no attachment, so the existence of restricted documents is never disclosed.
- Full Page Cache compatible — the list varies on the logged-in state Magento already caches on, and refreshes when the product is saved.
- Available in English, French, Dutch and Spanish.
Found a bug? Tell us about it.
A short form opens in a new tab — the module name and your language are already filled in. Share what you tried, what went wrong, and we will get back to you within one business day.
Report a bug for Product AttachmentNeed help?
Our team is available to assist with integration.