Restrict Attachments by Mimetype
Steps
An attachment can be turned down for its file type, so that a wiki takes images and plain text but not executables, or the other way round. The Attachment Validation Application puts two lists in the administration for that, one of the mimetypes to accept and one of the mimetypes to refuse. Both are empty on a new wiki, so nothing is restricted until you fill one. Attachments introduces the other limits an administrator can put on an upload.
- Select "Administer Wiki" and open "Attachments Restriction", in the "Content" category. To restrict one Page tree rather than the whole wiki, select "Administer Page" on the Page at the top of that tree: the same section is there.
- Fill "Allowed Mimetypes" with the mimetypes you accept, or "Blocked Mimetypes" with the ones you refuse, separated by commas.
text/plain,image/* - Select "Save". The field comes back with the same list separated by |, which XWiki reads exactly as the commas you typed.
- Attach a file of a refused type to a Page the restriction covers. The upload is turned down, and the notice names the mimetype XWiki found.
XWiki reads the mimetype out of the contents of the file, with Apache Tika, rather than out of its name, so renaming a file does not carry it past the restriction. A pattern matches a mimetype in full unless it carries a *, which stands for any text in that one place: image/* takes every kind of image and */pdf every flavor of PDF. Only the first * is a joker, and the pattern is neither a glob nor a regular expression. Write the patterns in lower case, because that is the form the detected mimetype is compared in. Where both lists are filled, an attachment has to be in the allowed list and out of the blocked list, so a mimetype named in both is refused. A file that is also too large never reaches this check: the maximum attachment size is looked at first.
FAQ
Can I restrict only part of a wiki?
Yes. "Administer Page" carries the same two fields for a Page and everything under it. XWiki takes the restriction from the Page being written to, then from each Page above it, and stops at the first list that is filled; the wiki setting answers only when no Page above holds one.
Can I set the restriction in a configuration file instead?
Yes. attachment.upload.allowList and attachment.upload.blockList in xwiki.properties are the last level XWiki looks at, after the Page tree and the wiki. An empty list counts as nothing set at all, so leaving a field of the administration empty lets the file answer instead of overriding it.
Is the restriction enforced in the browser only?
No. The browser turns the file down before sending it, going by the type the operating system reports, and XWiki runs its own check once the file arrives. A client that skips the first one has the upload turned down all the same.
