Known Problems
No user in CLI mode
We only assign an FE or BE user in frontend or backend context. CLI mode always runs as the same single, generic user, so assigning it as a file's creator or editor would not be meaningful.
No frontend user without a login
A contact or job application form usually has no frontend user login at
all, so there is no session to read a user ID from. checkfaluploads
still requires the rights checkbox to be confirmed before such an
upload is accepted, but fe_ on sys_ stays empty in
that case. There is no user to assign, so this is expected behavior,
not a bug.
Third-party extensions are not covered automatically
checkfaluploads only protects what TYPO3 core itself handles: the
File List module, the ElementBrowser, and inline file/media fields in
FormEngine. Extensions that implement their own upload logic on top of
Extbase or EXT:form, powermail's file upload field being one example,
are not covered just by installing checkfaluploads. Their developers
have to wire in FalUploadService or CheckFalUploadValidator by hand.