Order Attachment for Magento 2

MAGENTO 2 · CHECKOUT · FILES · ORDERS

Kowal Order Attachment

Add an image or PDF field to checkout, visible for all orders or selected products. Link the attachment to the purchase and make it available to authorized staff in the Magento panel.

JPG, PNG and PDF · Backend validation · Files outside pub/media

HOW IT WORKS IN PRACTICE

Order Attachment is a practical Magento 2 module for stores that need to collect additional files from customers related to an order. The extension is especially useful wherever photos, scans, PDF documents, graphic designs, confirmations, prescriptions, forms, or other materials provided by the customer are needed to complete a purchase.

The module adds a secure attachment field in checkout and saves the file together with the order. The form can be visible for all orders or only when the cart contains a product marked as requiring an attachment. This means the store does not force uploads where they are not needed, while still allowing precise handling of products that require additional data.

The module’s main advantage is control over the timing and security of file uploads. The attachment is validated on the backend, stored outside the public directory, and made available to administrators only through secured actions in the Magento admin panel. This reduces the risk of accidental exposure of customer files and eliminates the problem of public links to private documents.

After the order is placed, the administrator can see the attachment directly in the order view. They can download the file or open its preview if the format is supported. Popular image formats and PDF are supported, and the allowed extensions and maximum file size can be configured in the admin panel.

• Global enable or disable of the module in Magento configuration.
• Conditional display of the upload field in checkout.
• Support for per-product configuration through a product attribute.
• Option to require an attachment only for selected SKUs.
• Upload of images and PDF files.
• Backend validation of extension, MIME type, and file size.
• Secure file storage outside the public directory.
• Attachment linked to a specific order.
• File download link in the admin panel.
• Preview of supported files in the order view.
• Automatic cleanup of old temporary files.

The module is intended for Magento 2 stores that sell products or services requiring an additional file from the customer, for example:

• personalized products,
• printing and graphic arts,
• graphic services,
• medical or optical products requiring documents,
• orders requiring a reference photo,
• B2B products requiring confirmations or forms.

• Less manual email communication after an order is placed.
• Lower risk of losing a file, because the attachment goes directly to the order.
• Better handling process for products that require additional data.
• Greater control over the security of customer files.
• Simpler work for the administrative team in the Magento admin panel.

The administrator can set in the panel:

• whether the module is active,
• when the attachment field should be visible,
• whether the attachment is required,
• which file extensions are allowed,
• the maximum file size,
• whether the attachment should be visible in the order view,
• whether file preview is available.

The module was designed with the assumption that every uploaded file is untrusted. Therefore, files are validated on the server side, given secure technical names, and are not published as direct URLs in pub/media. Downloading and preview are handled through administrative controllers protected by Magento permissions.

Stores → Configuration → Sales → Order Attachments lets you set visibility, requirements, title, description, formats, limit and preview. By default the module is disabled, the form applies to selected products and the limit is 10 MB.

Supported extensions are jpg, jpeg, png and pdf. requires_order_attachment marks a product requiring the field; the cart also checks child products. Form visibility and requiring a file are separate settings.

The current checkout supports one file, its removal and re-upload. The validator rejects empty or oversized files, checks the extension and MIME from the content and also checks the %PDF- signature for PDFs.

Names with more than one dot are rejected, for example project.version.pdf. The configuration list does not add support for formats without a MIME mapping in the module. These checks do not replace an additional file scanner if your store's process requires one.

The upload is assigned to the quote and temporarily saved outside the public directory. Once the order is created, the file moves to its location, and cron removes old temporary files.

Preview and download require View Order Attachments permission and access to the order. The module's Configuration is a separate permission. You can also access it through kowal.store → Modules → Order Attachments → Configuration.

The form is a component of standard Magento checkout. Hyvä, alternative checkouts and headless require checks and a custom integration of the upload interface.

The requirement is also checked during quote submit, so orders through APIs or other paths must provide a valid attachment association. Do not assume that the lack of a form in an interface disables backend validation.

Package kowal/module-order-attachment, module Kowal_OrderAttachment. After configuring access to the Kowal repository, install the package, enable the module, update Magento, and clear the cache. In production, include compilation and static content deployment in accordance with the store's deployment process.

1. Set visibility and requirements
Configure the mode and mark selected products.

2. The customer uploads a file
The backend checks format, content and size.

3. Staff receive the attachment
After purchase, the file appears in the order view.

Mark the product with Requires Order Attachment. With such a cart, the customer sees the upload field and submits an image before purchase.

After the order is placed, an authorized administrator can download the file or open a supported preview. The material stays linked to that specific order.