Jump to content

RefractTrack Attachments

From Pixel Refraction Studio
Revision as of 23:25, 27 August 2026 by Nerdofepic (talk | contribs) (Created page with "== Attachments == Tasks support file attachments, gated by <code><nowiki>attachments:view</nowiki></code> / <code><nowiki>attachments:create</nowiki></code> / <code><nowiki>attachments:delete</nowiki></code>. === Storage === Uploaded files are stored on disk under <code><nowiki>uploads/tasks/<task_id>/</nowiki></code> with randomized filenames. By default only <code><nowiki>.jpg .jpeg .png .gif .webp .zip</nowiki></code> are accepted, and the allowed list is configura...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Attachments

Tasks support file attachments, gated by attachments:view / attachments:create / attachments:delete.

Storage

Uploaded files are stored on disk under uploads/tasks/<task_id>/ with randomized filenames. By default only .jpg .jpeg .png .gif .webp .zip are accepted, and the allowed list is configurable via ALLOWED_UPLOAD_EXTENSIONS in config/config.php (see Configuration). Maximum upload size is likewise configurable via MAX_UPLOAD_BYTES.

Access control

Attachments cannot be downloaded directly from /uploads/tasks/* — that path is blocked at the .htaccess level. The only way to reach an attachment is through attachment.php, which:

  1. Checks attachments:view
  2. Verifies the requesting user has access to the attachment's project
  3. Only then streams the file

This means an attachment's protection matches the task's own project access, not just a permission flag — a user can't reach a file for a project they haven't been granted access to even if they hold attachments:view globally.

Retrieved from "https://wiki.pixelrefraction.com/index.php?title=RefractTrack_Attachments&oldid=28"