Jump to content

RefractTrack Attachments: Difference between revisions

From Pixel Refraction Studio
Created page with "== Attachments == Tasks support file attachments, gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>. === Storage === Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the allowed list is configura..."
 
No edit summary
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
== Attachments ==
== Attachments ==


Tasks support file attachments, gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>.
Tasks can carry file attachments — a screenshot of a bug, a piece of reference art, a design doc, a sound cue, even a snippet of source code. RefractTrack accepts a wide range of file types right out of the box, grouped roughly like this:


=== Storage ===
* '''Images''' — jpg, png, gif, webp
* '''Archives''' — zip
* '''Office documents''' — pdf, rtf, Office documents and their OpenDocument equivalents
* '''Audio''' — wav, ogg, mp3, mid, aiff, flac, alac, mp4, aac, m4a
* '''Plain text and data''' — txt, json, markdown, csv, xml, yaml, log, ini, cfg, conf, and others
* '''Source code''' — the usual suspects (C#, C++, Java, Python, JavaScript/TypeScript, and more)
* '''Game engine specific''' — a broad set of game-engine-specific scripting and scene formats (Godot, GameMaker, Ren'Py, Roblox Luau, Papyrus, and others), handy for attaching a snippet straight from your project


Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the allowed list is configurable via <code><nowiki>ALLOWED_UPLOAD_EXTENSIONS</nowiki></code> in <code><nowiki>config/config.php</nowiki></code> (see [[RefractTrack_Configuration|Configuration]]). Maximum upload size is likewise configurable via <code><nowiki>MAX_UPLOAD_BYTES</nowiki></code>.
There's a small "?" button right next to the upload field on a task that lists everything currently accepted, grouped the same way, so nobody has to guess or come find this page mid-upload. An admin can widen or narrow the accepted list, and set a maximum file size, to suit your team — see your <code>config.php</code> if you're the one managing the server.


=== Access control ===
A couple of things are deliberately '''never''' accepted, on every install, for safety: anything that looks like an installer or executable, and <code>.svg</code> images (an SVG can secretly carry a script, which isn't something you want silently accepted as an "image").


Attachments cannot be downloaded directly from <code><nowiki>/uploads/tasks/*</nowiki></code> — that path is blocked at the <code><nowiki>.htaccess</nowiki></code> level. The only way to reach an attachment is through <code><nowiki>attachment.php</nowiki></code>, which:
=== Who can see what ===


# Checks <code><nowiki>attachments:view</nowiki></code>
Attachments follow the same access rules as everything else in RefractTrack: only people with permission to view attachments — and access to that specific project — can open a file. There's no way to guess or share a direct link that bypasses those checks; every download is checked first.
# Verifies the requesting user has access to the attachment's project
# Only then streams the file
 
This means an attachment's protection matches the task's own project access, not just a permission flag a user can't reach a file for a project they haven't been granted access to even if they hold <code><nowiki>attachments:view</nowiki></code> globally.


=== Related pages ===
=== Related pages ===


* [[RefractTrack_Tasks|Tasks]]
* [[RefractTrack_Tasks|Tasks]]
* [[RefractTrack_Security|Security]]
* [[RefractTrack_Permissions_and_Roles|Permissions and Roles]]
* [[RefractTrack_Permissions_and_Roles|Permissions and Roles]]
* [[RefractTrack_Export_and_Import|Export and Import]]
[[Category:RefractTrack]]

Latest revision as of 22:57, 11 September 2026

Attachments

Tasks can carry file attachments — a screenshot of a bug, a piece of reference art, a design doc, a sound cue, even a snippet of source code. RefractTrack accepts a wide range of file types right out of the box, grouped roughly like this:

  • Images — jpg, png, gif, webp
  • Archives — zip
  • Office documents — pdf, rtf, Office documents and their OpenDocument equivalents
  • Audio — wav, ogg, mp3, mid, aiff, flac, alac, mp4, aac, m4a
  • Plain text and data — txt, json, markdown, csv, xml, yaml, log, ini, cfg, conf, and others
  • Source code — the usual suspects (C#, C++, Java, Python, JavaScript/TypeScript, and more)
  • Game engine specific — a broad set of game-engine-specific scripting and scene formats (Godot, GameMaker, Ren'Py, Roblox Luau, Papyrus, and others), handy for attaching a snippet straight from your project

There's a small "?" button right next to the upload field on a task that lists everything currently accepted, grouped the same way, so nobody has to guess or come find this page mid-upload. An admin can widen or narrow the accepted list, and set a maximum file size, to suit your team — see your config.php if you're the one managing the server.

A couple of things are deliberately never accepted, on every install, for safety: anything that looks like an installer or executable, and .svg images (an SVG can secretly carry a script, which isn't something you want silently accepted as an "image").

Who can see what

Attachments follow the same access rules as everything else in RefractTrack: only people with permission to view attachments — and access to that specific project — can open a file. There's no way to guess or share a direct link that bypasses those checks; every download is checked first.