RefractTrack Attachments - Revision history

Nerdofepic at 22:57, 11 September 2026

2026-09-11T22:57:12Z

← Older revision		Revision as of 22:57, 11 September 2026
Line 5:		Line 5:
	* '''Images''' — jpg, png, gif, webp		* '''Images''' — jpg, png, gif, webp
	* '''Archives''' — zip		* '''Archives''' — zip
	* '''Office documents''' — pdf, ~~Word, Excel, PowerPoint~~, and their OpenDocument equivalents~~, plus rtf~~		* '''Office documents''' — pdf, rtf, Office documents and their OpenDocument equivalents
	* '''Audio''' — wav, mp3, ~~ogg~~, flac, ~~and a handful of others~~		* '''Audio''' — wav, ogg, mp3, mid, aiff, flac, alac, mp4, aac, m4a
	* '''Plain text and data''' — txt, markdown, csv, ~~json~~, yaml, log ~~files~~, and ~~similar~~		* '''Plain text and data''' — txt, json, markdown, csv, xml, yaml, log, ini, cfg, conf, and others
	* '''Source code''' — the usual suspects (C#, Java, Python, JavaScript/TypeScript~~, PHP~~, and more)~~, plus~~ a broad set of game-engine-specific scripting and scene formats (Godot, GameMaker, Ren'Py, Roblox Luau, Papyrus, and others), handy for attaching a snippet straight from your project		* '''Source code''' — the usual suspects (C#, C++, Java, Python, JavaScript/TypeScript, and more)
			* '''Game engine specific''' — a broad set of game-engine-specific scripting and scene formats (Godot, GameMaker, Ren'Py, Roblox Luau, Papyrus, and others), handy for attaching a snippet straight from your project

	There's a small "?" button right next to the upload field on a task that lists everything currently accepted, grouped the same way, so nobody has to guess or come find this page mid-upload. An admin can widen or narrow the accepted list, and set a maximum file size, to suit your team — see your <code>config.php</code> if you're the one managing the server.		There's a small "?" button right next to the upload field on a task that lists everything currently accepted, grouped the same way, so nobody has to guess or come find this page mid-upload. An admin can widen or narrow the accepted list, and set a maximum file size, to suit your team — see your <code>config.php</code> if you're the one managing the server.

Nerdofepic at 22:51, 11 September 2026

2026-09-11T22:51:02Z

← Older revision		Revision as of 22:51, 11 September 2026
Line 1:		Line 1:
	== Attachments ==		== Attachments ==

	Tasks can carry file attachments — a screenshot of a bug, a piece of reference art, a design doc, ~~whatever~~'~~s useful. By default~~, ~~image~~ files and ~~zip archives are~~ accepted~~; your~~ admin can widen or narrow ~~that~~ list, and set a maximum file size, to suit your team.		Tasks can carry file attachments — a screenshot of a bug, a piece of reference art, a design doc, a sound cue, even a snippet of source code. RefractTrack accepts a wide range of file types right out of the box, grouped roughly like this:

			* '''Images''' — jpg, png, gif, webp
			* '''Archives''' — zip
			* '''Office documents''' — pdf, Word, Excel, PowerPoint, and their OpenDocument equivalents, plus rtf
			* '''Audio''' — wav, mp3, ogg, flac, and a handful of others
			* '''Plain text and data''' — txt, markdown, csv, json, yaml, log files, and similar
			* '''Source code''' — the usual suspects (C#, Java, Python, JavaScript/TypeScript, PHP, and more), plus a broad set of game-engine-specific scripting and scene formats (Godot, GameMaker, Ren'Py, Roblox Luau, Papyrus, and others), handy for attaching a snippet straight from your project

			There's a small "?" button right next to the upload field on a task that lists everything currently accepted, grouped the same way, so nobody has to guess or come find this page mid-upload. An admin can widen or narrow the accepted list, and set a maximum file size, to suit your team — see your <code>config.php</code> if you're the one managing the server.

			A couple of things are deliberately '''never''' accepted, on every install, for safety: anything that looks like an installer or executable, and <code>.svg</code> images (an SVG can secretly carry a script, which isn't something you want silently accepted as an "image").

	=== Who can see what ===		=== Who can see what ===
Line 11:		Line 22:
	* [[RefractTrack_Tasks\|Tasks]]		* [[RefractTrack_Tasks\|Tasks]]
	* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]		* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]
			* [[RefractTrack_Export_and_Import\|Export and Import]]

	[[Category:RefractTrack]]		[[Category:RefractTrack]]

Nerdofepic at 03:35, 3 September 2026

2026-09-03T03:35:08Z

← Older revision		Revision as of 03:35, 3 September 2026
Line 11:		Line 11:
	* [[RefractTrack_Tasks\|Tasks]]		* [[RefractTrack_Tasks\|Tasks]]
	* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]		* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]

			[[Category:RefractTrack]]

Nerdofepic at 00:13, 29 August 2026

2026-08-29T00:13:04Z

← Older revision		Revision as of 00:13, 29 August 2026
Line 1:		Line 1:
	== Attachments ==		== Attachments ==

	Tasks ~~support~~ file attachments, ~~gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>~~.		Tasks can carry file attachments — a screenshot of a bug, a piece of reference art, a design doc, whatever's useful. By default, image files and zip archives are accepted; your admin can widen or narrow that list, and set a maximum file size, to suit your team.

	=== ~~Storage~~ ===		=== Who can see what ===

	Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the ~~allowed list is configurable via <code><nowiki>ALLOWED_UPLOAD_EXTENSIONS</nowiki></code>~~ in ~~<code><nowiki>config/config.php</nowiki></code> (see [[RefractTrack_Configuration\|Configuration]]). Maximum upload size is likewise configurable via <code><nowiki>MAX_UPLOAD_BYTES</nowiki></code>.~~		Attachments follow the same access rules as everything else in RefractTrack: only people with permission to view attachments — and access to that specific project — can open a file. There's no way to guess or share a direct link that bypasses those checks; every download is checked first.

	~~=== Access control ===~~

	~~Attachments cannot be downloaded directly from <code><nowiki>/uploads/tasks/*</nowiki></code> — that path is blocked at the <code><nowiki>.htaccess</nowiki></code> level. The~~ only ~~way~~ to ~~reach an attachment is through <code><nowiki>attachment.php</nowiki></code>, which:~~

	~~# Checks <code><nowiki>~~attachments~~:view</nowiki></code>~~
	~~# Verifies the requesting user has~~ access to ~~the attachment's~~ project
	~~# Only then streams the file~~

	~~This means an attachment's protection matches the task's own project access, not just a permission flag~~ — ~~a user~~ can~~'t reach~~ a file ~~for a project they haven~~'~~t been granted access~~ to ~~even if they hold <code><nowiki>attachments:view</nowiki></code> globally~~.

	=== Related pages ===		=== Related pages ===

	* [[RefractTrack_Tasks\|Tasks]]		* [[RefractTrack_Tasks\|Tasks]]
	* [[RefractTrack_Security\|Security]]
	* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]		* [[RefractTrack_Permissions_and_Roles\|Permissions and Roles]]

Nerdofepic: Created page with "== Attachments == Tasks support file attachments, gated by `attachments:view` / `attachments:create` / `attachments:delete`. === Storage === Uploaded files are stored on disk under `uploads/tasks//` with randomized filenames. By default only `.jpg .jpeg .png .gif .webp .zip` are accepted, and the allowed list is configura..."

2026-08-27T23:25:32Z

Created page with "== Attachments == Tasks support file attachments, gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>. === Storage === Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the allowed list is configura..."

New page

== Attachments ==

Tasks support file attachments, gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>.

=== Storage ===

Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the allowed list is configurable via <code><nowiki>ALLOWED_UPLOAD_EXTENSIONS</nowiki></code> in <code><nowiki>config/config.php</nowiki></code> (see [[RefractTrack_Configuration|Configuration]]). Maximum upload size is likewise configurable via <code><nowiki>MAX_UPLOAD_BYTES</nowiki></code>.

=== Access control ===

Attachments cannot be downloaded directly from <code><nowiki>/uploads/tasks/*</nowiki></code> — that path is blocked at the <code><nowiki>.htaccess</nowiki></code> level. The only way to reach an attachment is through <code><nowiki>attachment.php</nowiki></code>, which:

# Checks <code><nowiki>attachments:view</nowiki></code>
# Verifies the requesting user has access to the attachment's project
# Only then streams the file

This means an attachment's protection matches the task's own project access, not just a permission flag — a user can't reach a file for a project they haven't been granted access to even if they hold <code><nowiki>attachments:view</nowiki></code> globally.

=== Related pages ===

* [[RefractTrack_Tasks|Tasks]]
* [[RefractTrack_Security|Security]]
* [[RefractTrack_Permissions_and_Roles|Permissions and Roles]]