carrierwave 3.1.4 → 4.0.0.rc

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3fce89671ca96c66db403199f1eab005bdb208ae699bcd6c6d58d470ec337d96
-  data.tar.gz: 0047624b2e05641fbb2d65d97815726e9bc296fc8cdb53c37815ead2ce30d6e4
+  metadata.gz: 663f843bb0d228ae33a1afa9bf60c466ba068f7f13e5bd8cfa505de59029a34d
+  data.tar.gz: d6cdd19287a021a50268c48e2d4be4acf9bf1ed14680ff12c83c29226d7a7652
 SHA512:
-  metadata.gz: 5f63f1e37da1f107660263cc2d4be4e09dd0076e12bf80bc057449ddbd288887210ae17392d4092ff240c9992be3819721e7665a72023e4b58a8e9d351434d37
-  data.tar.gz: 205220c3605f50f23379781d94c587aee68a75aa7d4d854a258d362983122115641482098e81574dd873acce90deeb124d01b24c9ff7970dc45c2cb3146a9bd1
+  metadata.gz: 4eee63b300dfe7ce3d4f2061bb8681b0c23c6b434ab45fe19e015a1cb6a8bfd19c7a84a30f0454c84d23df843ce51e71498cde0b4fef671f941d94ee8e1160f5
+  data.tar.gz: e77c6b1e21ecf67d074b8fc893b4d762c3fca35fe69014bb9504bb98992ca49858ee8ad060b9e8905d897e18dd9169be0ef12ad6f640e4a02abd4e854f414e14

data/README.md

@@ -35,6 +35,23 @@ gem 'carrierwave', '~> 3.0'
 
 Finally, restart the server to apply the changes.
 
+### Supported Ruby and Rails versions
+
+Each release is tested against the versions below. The gemspec only states a
+minimum, so Bundler will happily install an old CarrierWave alongside a Rails
+newer than it has ever seen — which is how a patch-level upgrade ends up failing
+at boot. Check this table when upgrading Rails.
+
+| CarrierWave | Rails      | Ruby     |
+|-------------|------------|----------|
+| 4.0         | 7.0 – 8.1  | >= 2.7   |
+| 3.1         | 6.0 – 8.0  | >= 2.5   |
+| 3.0         | 6.0 – 7.1  | >= 2.5   |
+| 2.2         | 5.0 – 6.1  | >= 2.2.2 |
+
+Only the latest release gets fixes; older lines are listed so you can tell
+whether your combination was ever supported.
+
 ## Upgrading from 2.x or earlier
 
 CarrierWave 3.0 comes with a change in the way of handling the file extension on conversion. This results in following issues if you use `process convert: :format` to change the file format:
@@ -159,6 +176,14 @@ example, create a migration like this:
 
 __Note__: JSON datatype doesn't exists in SQLite adapter, that's why you can use a string datatype which will be serialized in model.
 
+Leave the column nullable: `NULL` is what it holds when no file is mounted, so a `default: []` or `null: false` on it doesn't hold — the `NULL` is written on save. The uploader's own readers answer an empty array either way, and are what to read:
+
+```ruby
+user.avatars             # => [] when there is no file
+user.avatars_identifiers # => []
+user[:avatars]           # => nil, the column as it is stored
+```
+
 Open your model file and mount the uploader:
 
 
@@ -223,7 +248,7 @@ end
 This works for the file storage as well as Amazon S3 and Rackspace Cloud Files.
 Define `store_dir` as `nil` if you'd like to store files at the root level.
 
-If you store files outside the project root folder, you may want to define `cache_dir` in the same way:
+With the `:file` storage, if you store files outside the project root folder, you may want to define `cache_dir` in the same way:
 
 ```ruby
 class MyUploader < CarrierWave::Uploader::Base
@@ -245,6 +270,14 @@ class MyUploader < CarrierWave::Uploader::Base
 end
 ```
 
+The name is worked out again whenever the stored file is located, so it has to come out the same every time. Memoise anything that would otherwise differ per call, in an instance variable of your own, as `@filename` is the uploader's:
+
+```ruby
+def filename
+  @stable_filename ||= "#{SecureRandom.uuid}.#{file.extension}"
+end
+```
+
 Some old documentations (like [this](https://stackoverflow.com/a/5865117)) may instruct you to safeguard the filename value with `if original_filename`, but it's no longer necessary with CarrierWave 3.0 or later.
 
 ## Securing uploads
@@ -378,6 +411,32 @@ class MyUploader < CarrierWave::Uploader::Base
 end
 ```
 
+`process convert: format` cannot be given a condition. The file extension follows the
+conversion, and it has to be worked out again when the file is retrieved, where whether
+the condition held is not known. Convert unconditionally, or give the format a version
+of its own:
+
+```ruby
+version :webp, if: :convert_to_webp? do
+  process convert: :webp   # unconditional within the version
+end
+```
+
+If you need to convert on a condition and keep it on the uploader itself, take the
+naming over so that it still follows from the identifier:
+
+```ruby
+process :to_jpeg, if: :heic?
+
+def to_jpeg
+  minimagick! { |builder| builder.convert('jpg') }
+end
+
+def full_filename(for_file)
+  for_file.sub(/\.heic\z/i, '.jpg')
+end
+```
+
 ### Nested versions
 
 It is possible to nest versions within versions:
@@ -424,6 +483,13 @@ end
 ```
 
 The `model` variable points to the instance object the uploader is attached to.
+The condition is evaluated when the version is accessed, so it isn't called at all
+as long as you only use the original file.
+
+Note that `present?` on a version only tells whether a file is assigned, not whether
+that version was actually created. Use `uploader.thumb.exists?` to ask the storage,
+which costs a request when the storage is a remote one, or
+[record what was stored](#recording-what-was-stored) to have the answer at hand.
 
 ### Create versions from existing versions
 
@@ -466,7 +532,44 @@ end
 
 Please note that `#full_filename` mustn't be constructed based on a dynamic value
 that can change from the time of store and time of retrieval, since it will result in
-being unable to retrieve a file previously stored.
+being unable to retrieve a file previously stored. Storing refuses to leave a file
+somewhere a later request would not look, so this is caught rather than silent.
+
+## Recording what was stored
+
+By default CarrierWave persists the identifier alone, and works out everything else on
+retrieval by re-running the uploader's definition and asking the storage. Which versions
+a conditional creates is decided when the file is stored, so re-deciding it later can
+give a different answer than what is actually there, and asking a remote storage for
+things like the size costs a request per record.
+
+Give the mount a column to record it in, and it stops guessing:
+
+```ruby
+class Event < ActiveRecord::Base
+  mount_uploader :image, ImageUploader, metadata_column: :image_metadata
+end
+```
+
+```ruby
+add_column :events, :image_metadata, :json
+```
+
+The column can be a `json`/`jsonb` one, a serialized one, or plain text holding JSON.
+For `mount_uploaders` it holds one set of facts per file.
+
+Records stored before the column was added have nothing recorded, and keep working as
+they always have, so no backfill is needed.
+
+Override `#build_metadata` to record your own facts:
+
+```ruby
+class ImageUploader < CarrierWave::Uploader::Base
+  def build_metadata
+    super.merge('width' => width, 'height' => height)
+  end
+end
+```
 
 ## Making uploads work across form redisplays
 
@@ -500,6 +603,11 @@ case of images, a small thumbnail would be a good indicator:
 <% end %>
 ```
 
+When the cache storage is a remote one, uploading the cached file to it is deferred until
+it turns out to be needed beyond the current request, which reading `avatar_cache` or
+`avatar_url` tells CarrierWave. If you carry the cache name over by other means, call
+`user.avatar.materialize_cache!` before handing it out.
+
 ## Removing uploaded files
 
 If you want to remove a previously uploaded file on a mounted uploader, you can
@@ -562,6 +670,57 @@ CarrierWave.configure do |config|
 end
 ```
 
+## Uploading directly to the storage
+
+When the file is stored on a cloud service, it can be uploaded straight to it,
+without the bytes passing through your application. `#direct_upload` tells the
+client where to put the file, and under which name to hand it back afterwards:
+
+```ruby
+class UploadsController < ApplicationController
+  def create
+    upload = User.new.avatar.direct_upload(filename: params[:filename])
+    render json: upload.to_h
+    # => { url: "https://mybucket.s3.amazonaws.com/uploads/tmp/1758…-4829/cat.jpg?X-Amz-…",
+    #      method: "PUT", headers: {}, cache_name: "1758…-4829/cat.jpg" }
+  end
+end
+```
+
+The file goes where the cache expects it, so the upload is finished by assigning
+the returned name to the `avatar_cache` field you already have for form
+redisplays. In the browser:
+
+```js
+const upload = await (await fetch(`/uploads?filename=${encodeURIComponent(file.name)}`)).json();
+await fetch(upload.url, { method: upload.method, headers: upload.headers, body: file });
+document.querySelector('#user_avatar_cache').value = upload.cache_name;
+// then submit the form as usual
+```
+
+The file is stored where it belongs when the record is saved, as any cached file
+is. Libraries which upload for you take the same three values: with
+[Uppy](https://uppy.io/docs/aws-s3/), return `upload.to_h` from
+`getUploadParameters`.
+
+The cache has to be on the cloud service for this, which it is when `storage` is
+set to `:fog` and `cache_storage` is left alone. A few more things to know:
+
+* the filename is sanitized before it is signed into the URL, so the name the
+  file is stored under is the one in `cache_name`, not the one you passed;
+* the upload stays possible for `fog_authenticated_url_expiration` seconds, which
+  `expires_in:` overrides;
+* the size cannot be limited by the URL. Check it in the client and again with
+  `size_range` when the file comes back, and let `clean_cached_files!` or a
+  lifecycle rule on the cache directory collect what was uploaded and never used;
+* pass `content_type:` to fix the type the client has to send. It is signed into
+  the URL and returned in `headers`, so the client has to send exactly that;
+* uploaders which process what they store, or have versions, refuse to hand out
+  an upload: neither can be done to a file the application never sees.
+
+Your storage service has to allow the upload to be made from the browser, which
+for S3 means a CORS rule allowing `PUT` from your origin.
+
 ## Providing a default URL
 
 In many cases, especially when working with images, it might be a good idea to
@@ -946,6 +1105,10 @@ end
 If you're uploading images, you'll probably want to manipulate them in some way,
 you might want to create thumbnail images for example.
 
+The processing library itself is not a dependency of CarrierWave, so add the one
+your uploaders use to your own Gemfile — `mini_magick`, `ruby-vips` or `rmagick`
+— along with the tool it drives (ImageMagick or libvips).
+
 ### Using MiniMagick
 
 MiniMagick performs all the operations using the 'convert' CLI which is part of the standard ImageMagick kit.
@@ -1024,10 +1187,24 @@ class ImageFileUploader < CarrierWave::Uploader::Base
 end
 ````
 
+For anything the methods below don't cover, `vips!` yields the [ImageProcessing](https://github.com/janko/image_processing/blob/master/doc/vips.md) builder (`minimagick!` does the same for MiniMagick). For example, to strip the metadata and set the quality:
+
+````ruby
+class ImageFileUploader < CarrierWave::Uploader::Base
+  include CarrierWave::Vips
+
+  process :optimize
+
+  def optimize
+    vips! { |builder| builder.saver(strip: true, quality: 90) }
+  end
+end
+````
+
 ### List of available processing methods:
 
 > [!NOTE]
-> While the intention is to provide uniform interfaces to all three processing libraries the availability and implementation of processing methods can <a href="supported-processing-methods">vary slightly between them</a>.
+> While the intention is to provide uniform interfaces to all three processing libraries the availability and implementation of processing methods can <a href="#supported-processing-methods">vary slightly between them</a>.
 
 - `convert` - Changes the image encoding format to the given format (eg. jpg). This operation is treated specially to trigger the change of the file extension, so it matches with the format of the resulting file.
 - `resize_to_limit` - Resize the image to fit within the specified dimensions while retaining the original aspect ratio. Will only resize the image if it is larger than the specified dimensions. The resulting image may be shorter or narrower than specified in the smaller dimension but will not be larger than the specified values.

data/lib/carrierwave/direct_upload.rb

@@ -0,0 +1,20 @@
+module CarrierWave
+  ##
+  # What a client needs to upload a file straight into the cache. See
+  # CarrierWave::Uploader::DirectUpload#direct_upload.
+  #
+  class DirectUpload
+    attr_reader :url, :method, :headers, :cache_name
+
+    def initialize(url:, cache_name:, headers: {}, method: 'PUT')
+      @url = url
+      @cache_name = cache_name
+      @headers = headers
+      @method = method
+    end
+
+    def to_h
+      { url: url, method: method, headers: headers, cache_name: cache_name }
+    end
+  end # DirectUpload
+end # CarrierWave

data/lib/carrierwave/downloader/base.rb

@@ -1,6 +1,6 @@
 require 'open-uri'
 require 'ssrf_filter'
-require 'addressable'
+require 'addressable/uri'
 require 'carrierwave/downloader/remote_file'
 
 module CarrierWave
@@ -8,6 +8,14 @@ module CarrierWave
     class Base
       include CarrierWave::Utilities::Uri
 
+      # Leftovers from pasting, removed before parsing as in the first steps of
+      # https://url.spec.whatwg.org/#concept-basic-url-parser
+      LEADING_TRAILING_JUNK = /\A[\x00-\x20]+|[\x00-\x20]+\z/.freeze
+      EMBEDDED_JUNK = /[\t\n\r]/.freeze
+      # Matches a host name with an optional port, but not a scheme like 'http://' or 'data:'
+      HOSTISH = /\A[[:alnum:]][[:alnum:]\-._]*(?::\d+)?(?:[\/?#]|\z)/.freeze
+      DEFAULT_SCHEME = 'https'.freeze
+
       attr_reader :uploader
 
       def initialize(uploader)
@@ -29,15 +37,16 @@ module CarrierWave
         uri = process_uri(url.to_s)
         begin
           if skip_ssrf_protection?(uri)
-            response = OpenURI.open_uri(process_uri(url.to_s), headers)
+            response = OpenURI.open_uri(uri, headers)
           else
             request = nil
+            ssrf_options = @uploader.ssrf_filter_options || {}
             if ::SsrfFilter::VERSION.to_f < 1.1
-              response = SsrfFilter.get(uri, headers: headers) do |req|
+              response = SsrfFilter.get(uri, headers: headers, **ssrf_options) do |req|
                 request = req
               end
             else
-              response = SsrfFilter.get(uri, headers: headers, request_proc: ->(req) { request = req }) do |res|
+              response = SsrfFilter.get(uri, headers: headers, request_proc: ->(req) { request = req }, **ssrf_options) do |res|
                 res.body # ensure to read body
               end
             end
@@ -59,22 +68,42 @@ module CarrierWave
       ##
       # Processes the given URL by parsing it, and escaping if necessary. Public to allow overriding.
       #
+      # Never decodes, as that would make %2F and '/', %2B and '+' indistinguishable.
+      #
       # === Parameters
       #
       # [url (String)] The URL where the remote file is stored
       #
       def process_uri(source)
-        uri = Addressable::URI.parse(source)
+        uri = Addressable::URI.parse(normalize_input(source))
         uri.host = uri.normalized_host
-        # Perform decode first, as the path is likely to be already encoded
-        uri.path = encode_path(decode_uri(uri.path)) if uri.path =~ CarrierWave::Utilities::Uri::PATH_UNSAFE
-        uri.query = encode_non_ascii(uri.query) if uri.query
-        uri.fragment = encode_non_ascii(uri.fragment) if uri.fragment
+        uri.path = sanitize_component(uri.path, SANITIZE_PATH) if uri.path
+        uri.query = sanitize_component(uri.query, SANITIZE_QUERY) if uri.query
+        uri.fragment = sanitize_component(uri.fragment, SANITIZE_FRAGMENT) if uri.fragment
         URI.parse(uri.to_s)
       rescue URI::InvalidURIError, Addressable::URI::InvalidURIError
         raise CarrierWave::DownloadError, "couldn't parse URL: #{source}"
       end
 
+      ##
+      # Cleans up a URL as pasted by an end user, since `remote_#{column}_url=` is meant to be
+      # fed from a text field. Public to allow overriding.
+      #
+      # === Parameters
+      #
+      # [source (String)] The URL given by the user
+      #
+      def normalize_input(source)
+        source = source.to_s.gsub(LEADING_TRAILING_JUNK, '').gsub(EMBEDDED_JUNK, '')
+
+        return "#{DEFAULT_SCHEME}:#{source}" if source.start_with?('//')
+        # Don't promote a local path like '/etc/passwd' into a URL
+        return source if source.start_with?('/')
+        return "#{DEFAULT_SCHEME}://#{source}" if source.match?(HOSTISH)
+
+        source
+      end
+
       ##
       # If this returns true, SSRF protection will be bypassed.
       # You can override this if you want to allow accessing specific local URIs that are not SSRF exploitable.

data/lib/carrierwave/downloader/remote_file.rb

@@ -1,6 +1,8 @@
 module CarrierWave
   module Downloader
     class RemoteFile
+      include CarrierWave::Utilities::Uri
+
       attr_reader :file, :uri
 
       def initialize(file)
@@ -53,7 +55,7 @@ module CarrierWave
       end
 
       def filename_from_uri
-        CGI.unescape(File.basename(uri.path))
+        decode_path(File.basename(uri.path))
       end
 
       def method_missing(*args, &block)

data/lib/carrierwave/error.rb

@@ -5,4 +5,5 @@ module CarrierWave
   class ProcessingError < UploadError; end
   class DownloadError < UploadError; end
   class UnknownStorageError < StandardError; end
+  class FilenameNotReproducible < StandardError; end
 end

data/lib/carrierwave/locale/en.yml

@@ -9,6 +9,8 @@ en:
       content_type_allowlist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
       content_type_denylist_error: "You are not allowed to upload %{content_type} files"
       processing_error: "Failed to manipulate, maybe it is not an image?"
+      unsupported_image_format_error: "Failed to manipulate, file format is not supported"
+      filename_too_long_error: "File name is too long"
       min_size_error: "File size should be greater than %{min_size}"
       max_size_error: "File size should be less than %{max_size}"
       min_width_error: "Image width should be greater than %{min_width}px"

data/lib/carrierwave/mount.rb

@@ -102,6 +102,7 @@ module CarrierWave
     # === Options
     #
     # [:mount_on => Symbol] if the name of the column to be serialized to differs you can override it using this option
+    # [:metadata_column => Symbol] the column to record what was stored in, so that it does not have to be worked out again
     # [:ignore_integrity_errors => Boolean] if set to true, integrity errors will result in caching failing silently
     # [:ignore_processing_errors => Boolean] if set to true, processing errors will result in caching failing silently
     #
@@ -174,6 +175,10 @@ module CarrierWave
           _mounter(:#{column}).read_identifiers[0]
         end
 
+        def #{column}_identifier=(identifier)
+          _mounter(:#{column}).identifiers = [identifier]
+        end
+
         def #{column}_integrity_error
           #{column}_integrity_errors.last
         end
@@ -247,6 +252,7 @@ module CarrierWave
     # === Options
     #
     # [:mount_on => Symbol] if the name of the column to be serialized to differs you can override it using this option
+    # [:metadata_column => Symbol] the column to record what was stored in, so that it does not have to be worked out again
     # [:ignore_integrity_errors => Boolean] if set to true, integrity errors will result in caching failing silently
     # [:ignore_processing_errors => Boolean] if set to true, processing errors will result in caching failing silently
     #
@@ -319,6 +325,10 @@ module CarrierWave
         def #{column}_identifiers
           _mounter(:#{column}).read_identifiers
         end
+
+        def #{column}_identifiers=(identifiers)
+          _mounter(:#{column}).identifiers = identifiers
+        end
       RUBY
     end
 

data/lib/carrierwave/mounter.rb

@@ -1,3 +1,6 @@
+require "json"
+require "active_support/core_ext/array/wrap"
+
 module CarrierWave
 
   # this is an internal class, used by CarrierWave::Mount so that
@@ -8,6 +11,10 @@ module CarrierWave
         uploaders.first&.identifier
       end
 
+      def metadata
+        uploaders.first&.build_metadata
+      end
+
       def temporary_identifier
         temporary_identifiers.first
       end
@@ -18,6 +25,10 @@ module CarrierWave
         uploaders.map(&:identifier).presence
       end
 
+      def metadata
+        uploaders.map(&:build_metadata).presence
+      end
+
       def temporary_identifier
         temporary_identifiers.presence
       end
@@ -63,18 +74,35 @@ module CarrierWave
       [record.read_uploader(serialization_column)].flatten.reject(&:blank?)
     end
 
+    ##
+    # The stored metadata, as many as there are identifiers. Whatever the column gives
+    # is accepted, so that it can be a json column, a serialized one, or plain text.
+    #
+    def read_metadata
+      return [] unless metadata_column
+
+      value = record.read_uploader(metadata_column)
+      value = JSON.parse(value) rescue nil if value.is_a?(String)
+      Array.wrap(value)
+    end
+
     def uploaders
-      @uploaders ||= read_identifiers.map do |identifier|
-        uploader = blank_uploader
-        uploader.retrieve_from_store!(identifier)
-        uploader
+      @uploaders ||= begin
+        metadata = read_metadata
+        read_identifiers.each_with_index.map do |identifier, index|
+          uploader = blank_uploader
+          # Has to come first, as retrieval derives the path from what was recorded
+          uploader.metadata = metadata[index]
+          uploader.retrieve_from_store!(identifier)
+          uploader
+        end
       end
     end
 
     def cache(new_files)
       return if !new_files.is_a?(Array) && new_files.blank?
       old_uploaders = uploaders
-      @uploaders = new_files.map do |new_file|
+      attempts = new_files.map do |new_file|
         handle_error do
           if new_file.is_a?(String)
             if (uploader = old_uploaders.detect { |old_uploader| old_uploader.identifier == new_file })
@@ -95,12 +123,36 @@ module CarrierWave
             uploader
           end
         end
-      end.reject(&:blank?)
+      end
+      errors, new_uploaders = attempts.partition { |attempt| attempt.is_a?(CarrierWave::UploadError) }
+      # A refusal didn't ask for the mounted file to go
+      return if errors.any? && new_uploaders.all?(&:blank?)
+
+      @uploaders = new_uploaders.reject(&:blank?)
+      @removed_uploaders += (old_uploaders - @uploaders)
+      write_temporary_identifier
+    end
+
+    ##
+    # Takes the stored files with the given identifiers as the mounted ones, for when
+    # they were put in the store by something other than CarrierWave.
+    #
+    def identifiers=(new_identifiers)
+      return if !new_identifiers.is_a?(Array) && new_identifiers.blank?
+
+      old_uploaders = uploaders
+      @uploaders = new_identifiers.map do |identifier|
+        next if identifier.blank?
+
+        blank_uploader.tap { |uploader| uploader.adopt!(identifier) }
+      end.compact
       @removed_uploaders += (old_uploaders - @uploaders)
       write_temporary_identifier
     end
 
     def cache_names
+      # The names are carried over to the next request, which the files have to survive
+      uploaders.each(&:materialize_cache!)
       uploaders.map(&:cache_name).compact
     end
 
@@ -128,14 +180,20 @@ module CarrierWave
       @download_errors.clear
       @remote_urls = urls
 
-      clear_unstaged
-      @remote_urls.zip(remote_request_headers || []) do |url, header|
+      old_uploaders = uploaders
+      attempts = @remote_urls.zip(remote_request_headers || []).map do |url, header|
         handle_error do
           uploader = blank_uploader
           uploader.download!(url, header || {})
-          @uploaders << uploader
+          uploader
         end
       end
+      errors, new_uploaders = attempts.partition { |attempt| attempt.is_a?(CarrierWave::UploadError) }
+      # A refusal didn't ask for the mounted file to go
+      return if errors.any? && new_uploaders.all?(&:blank?)
+
+      @uploaders = old_uploaders.select(&:staged) + new_uploaders.reject(&:blank?)
+      @removed_uploaders += (old_uploaders - @uploaders)
       write_temporary_identifier
     end
 
@@ -157,6 +215,7 @@ module CarrierWave
       @added_uploaders += additions
 
       record.write_uploader(serialization_column, identifier)
+      record.write_uploader(metadata_column, metadata) if metadata_column
     end
 
     def urls(*args)
@@ -178,7 +237,8 @@ module CarrierWave
     end
 
     def remove!
-      uploaders.each(&:remove!)
+      # The reader leaves a blank uploader in place, which has nothing to remove
+      uploaders.reject { |uploader| uploader.file.nil? }.each(&:remove!)
       clear!
     end
 
@@ -197,10 +257,14 @@ module CarrierWave
       option(:mount_on) || column
     end
 
+    def metadata_column
+      option(:metadata_column)
+    end
+
     def remove_previous
       current_paths = uploaders.map(&:path)
       @removed_uploaders
-        .reject {|uploader| current_paths.include?(uploader.path) }
+        .reject {|uploader| uploader.file.nil? || current_paths.include?(uploader.path) }
         .each { |uploader| uploader.remove! if uploader.remove_previously_stored_files_after_update }
       reset_changes!
     end
@@ -227,17 +291,21 @@ module CarrierWave
       @removed_uploaders += unstaged
     end
 
+    # Records the error and gives it back, unless the mount wants it raised
     def handle_error
       yield
     rescue CarrierWave::DownloadError => e
       @download_errors << e
       raise e unless option(:ignore_download_errors)
+      e
     rescue CarrierWave::ProcessingError => e
       @processing_errors << e
       raise e unless option(:ignore_processing_errors)
+      e
     rescue CarrierWave::IntegrityError => e
       @integrity_errors << e
       raise e unless option(:ignore_integrity_errors)
+      e
     end
 
     def write_temporary_identifier