RestrictAttachments - Revision history

Robl: Add DisableAttachments option

2025-12-18T12:26:06Z

Add DisableAttachments option

← Older revision		Revision as of 08:26, 18 December 2025
Line 34:		Line 34:
	=== Implementing in RT (6.0.2 and possibly older) ===		=== Implementing in RT (6.0.2 and possibly older) ===

	* Install local modified version of [https://gist.github.com/listerr/~~4445b14adea8f801970ce7daf7d9613e~~ AddAttachments] Mason template. From your RT directory, e.g. (/opt/rt6)		* Install local modified version of [https://gist.github.com/listerr/b274f2ae0529ffeb337e5a1c0c6ce017 AddAttachments] Mason template. From your RT directory, e.g. (/opt/rt6)

	<nowiki>		<nowiki>
Line 40:		Line 40:
	# mkdir -p local/html/Ticket/Elements		# mkdir -p local/html/Ticket/Elements
	# cd local/html/Ticket/Elements		# cd local/html/Ticket/Elements
	# wget https://gist.githubusercontent.com/listerr/~~4445b14adea8f801970ce7daf7d9613e~~/raw/~~83b93f6f3d410432b5d354a487278bea34b1e6d5~~/AddAttachments		# wget https://gist.githubusercontent.com/listerr/b274f2ae0529ffeb337e5a1c0c6ce017/raw/3721f96ae4d9ff36777c4e7fb0cf6a9a616ffbb3/AddAttachments
	</nowiki>		</nowiki>

Line 111:		Line 111:

	* Deleting file attachments involves changing the message structure (e.g. unpacking the entire message, removing the unwanted part(s) and creating a new message with the correct MIME headers etc.) This is quite a complex process. For this reason, RT does not remove the attachment, but instead replaces it with a .txt part with the message <code>attachment type .... dropped - file type not permitted</code>		* Deleting file attachments involves changing the message structure (e.g. unpacking the entire message, removing the unwanted part(s) and creating a new message with the correct MIME headers etc.) This is quite a complex process. For this reason, RT does not remove the attachment, but instead replaces it with a .txt part with the message <code>attachment type .... dropped - file type not permitted</code>

			== 3. Disable file attachments in web frontend ==

			To completely disable file attachments in the web frontend:

			* Follow the instructions above for '''Restricting via RT Web Interface'''.

			* Add the following new RT config option to your '''RT_SiteConfig.d''' files, e.g.: <code>/opt/rt6/etc/RT_SiteConfig.d/20-RT_AttachmentRestrict.pm</code> :

			<nowiki>
			Set($DisableAttachments, 1);</nowiki>

			* '''Clear the Mason cache''' and restart everything.

Robl: /* Implementing in RT (6.0.2 and possibly older) */

2025-12-18T11:58:56Z

Implementing in RT (6.0.2 and possibly older)

← Older revision		Revision as of 07:58, 18 December 2025
Line 43:		Line 43:
	</nowiki>		</nowiki>

	* Add the following new RT config option to your '''RT_SiteConfig.d''' files, e.g.: /opt/rt6/etc/RT_SiteConfig.d/20-RT_AttachmentRestrict.pm :		* Add the following new RT config option to your '''RT_SiteConfig.d''' files, e.g.: <code>/opt/rt6/etc/RT_SiteConfig.d/20-RT_AttachmentRestrict.pm</code> :

	<nowiki>		<nowiki>
Line 77:		Line 77:

	* This may be a little inflexible because it applies globally for all attachment uploads. It would need further modifications, for example, to apply only to some queues but not others, or to allow different restrictions depending on user or queue.		* This may be a little inflexible because it applies globally for all attachment uploads. It would need further modifications, for example, to apply only to some queues but not others, or to allow different restrictions depending on user or queue.


	== 2. Restricting via RT backend ==		== 2. Restricting via RT backend ==

Robl at 11:49, 18 December 2025

2025-12-18T11:49:18Z

← Older revision		Revision as of 07:49, 18 December 2025
Line 109:		Line 109:
	'''NOTES''':		'''NOTES''':

	* This method will still allow files to be uploaded via the Web interface - attachments are only rejected once RT tries to add them to a ticket.		* This method will still allow files to be uploaded via the Web interface - attachments are only rejected once RT tries to add them to a ticket. This means a correspondence will still be sent, but without the file attachment. A warning will appear on the ticket to show the attachment was rejected.

	* Deleting file attachments involves changing the message structure (e.g. unpacking the entire message, removing the unwanted part(s) and creating a new message with the correct MIME headers etc.) This is quite a complex process. For this reason, RT does not remove the attachment, but instead replaces it with a .txt part with the message <code>attachment type .... dropped - file type not permitted</code>		* Deleting file attachments involves changing the message structure (e.g. unpacking the entire message, removing the unwanted part(s) and creating a new message with the correct MIME headers etc.) This is quite a complex process. For this reason, RT does not remove the attachment, but instead replaces it with a .txt part with the message <code>attachment type .... dropped - file type not permitted</code>

Robl: add Record_Local.pm method

2025-12-18T11:47:32Z

add Record_Local.pm method

@@ Line 32: / Line 32: @@
 acceptedFiles: image/*,application/pdf,.csv</nowiki>
-=== Implementing in RT (6.x and possibly older) ===
+=== Implementing in RT (6.0.2 and possibly older) ===
 * Install local modified version of [https://gist.github.com/listerr/4445b14adea8f801970ce7daf7d9613e AddAttachments] Mason template. From your RT directory, e.g. (/opt/rt6)
@@ Line 70: / Line 70: @@
 '''NOTES''':
-* RT has a config option, '''$PreferDropzone''' which is enabled by default. However, users can change this option in their preferences to disable Dropzone. '''This modified AddAttachments ignores the user preference setting''' to prevent users bypassing attachment restrictions by disabling Dropzone.
+* This method will not restrict attachments added outside the web interface, or not using Dropzone.
-* You may need to check this template when there upgrading to new releases/updates of RT. The installed version is in '''share/html/Ticket/Elements/AddAttachments''' by default.
+* RT has a config option, <code>$PreferDropzone</code> which is enabled by default. However, users can change this option in their preferences to disable Dropzone. '''This modified AddAttachments ignores the user preference setting''' to prevent users bypassing attachment restrictions by disabling Dropzone.
 * This may be a little inflexible because it applies globally for all attachment uploads. It would need further modifications, for example, to apply only to some queues but not others, or to allow different restrictions depending on user or queue.
-Alternative method in the RT back-end. This will restrict all attachments received via email and the web interface.
+== 2. Restricting via RT backend ==

Robl at 19:26, 17 December 2025

2025-12-17T19:26:15Z

← Older revision		Revision as of 15:26, 17 December 2025
Line 43:		Line 43:
	</nowiki>		</nowiki>

	* Add a new RT config option to your '''RT_SiteConfig.d''' files, e.g.:		* Add the following new RT config option to your '''RT_SiteConfig.d''' files, e.g.: /opt/rt6/etc/RT_SiteConfig.d/20-RT_AttachmentRestrict.pm :

	<nowiki>		<nowiki>
	~~# cd /opt/rt6/etc/RT_SiteConfig.d~~		Set($AcceptedFiles, 'image/*,application/pdf,.csv');</nowiki>
	~~# echo '~~Set($AcceptedFiles, 'image/*,application/pdf,.csv');~~' > 20-RT_AttachmentRestrict.pm~~
	</nowiki>

	* '''Clear the Mason cache''' and restart everything.		* '''Clear the Mason cache''' and restart everything.
Line 79:		Line 77:

	== 2. Restricting via RT back-end ==		== 2. Restricting via RT back-end ==

			Alternative method in the RT back-end. This will restrict all attachments received via email and the web interface.

Robl at 19:14, 17 December 2025

2025-12-17T19:14:31Z

@@ Line 50: / Line 50: @@
   </nowiki>
-* '''Clear the Mason cache''' and restart everything. NOTE: This will vary depending on your installation of RT and OS/Distro, e.g. if you installed RT from source or using a package manager. Mine (on nginx and systemd) looks something like this:
+* '''Clear the Mason cache''' and restart everything.
   <nowiki>
@@ Line 66: / Line 69: @@
 # service nginx stop && systemctl stop rt-server.socket && systemctl stop rt-server.service && rm -rf /opt/rt6/var/mason_data/obj && systemctl start rt-server.socket && systemctl start rt-server.service && service nginx start
 </nowiki>

Robl: add new page

2025-12-17T19:01:15Z

add new page

New page

= Restricting Attachments in RT =

== Existing Attachment Restrictions ==

RT has existing config options to set a maximum file size for attachments, and if files exceeding this size limit should be truncated or dropped.

See config options:

* [https://docs.bestpractical.com/rt/6.0.2/RT_Config.html#MaxAttachmentSize MaxAttachmentSize]
* [https://docs.bestpractical.com/rt/6.0.2/RT_Config.html#TruncateLongAttachments TruncateLongAttachments]
* [https://docs.bestpractical.com/rt/6.0.2/RT_Config.html#DropLongAttachments DropLongAttachments]

== Restricting attachment types ==

RT (as of 6.0.2) does not currently have a way to restrict attachments only to specific types, and there is no easy way to disable all attachments.

There are two methods to customise RT to restrict file attachments, depending on where you need to restrict:

# Restrict which file types can be uploaded via the web interface (When users upload attachments)
# Add a back-end overlay which restricts which attachment types will be stored globally, including via email, or any transaction involving attachments.

== 1. Restricting via RT Web Interface ==

RT uses the JavaScript library [https://docs.dropzone.dev/ Dropzone] in the web UI to handle file uploads.

Dropzone has an option '''acceptedFiles''' to limit the file type and/or extensions accepted.

This checks the file's MIME type or extension against this list. This is a '''comma separated list''' of MIME types or file extensions, e.g., The following would allow all image files, any file with MIME type application/pdf, and any file with extension .csv. All other file types will be rejected:

<nowiki>
acceptedFiles: image/*,application/pdf,.csv</nowiki>

=== Implementing in RT (6.x and possibly older) ===

* Install local modified version of [https://gist.github.com/listerr/4445b14adea8f801970ce7daf7d9613e AddAttachments] Mason template. From your RT directory, e.g. (/opt/rt6)

<nowiki>
# cd /opt/rt6
# mkdir -p local/html/Ticket/Elements
# cd local/html/Ticket/Elements
# wget https://gist.githubusercontent.com/listerr/4445b14adea8f801970ce7daf7d9613e/raw/83b93f6f3d410432b5d354a487278bea34b1e6d5/AddAttachments
</nowiki>

* Add a new RT config option to your '''RT_SiteConfig.d''' files, e.g.:

<nowiki>
# cd /opt/rt6/etc/RT_SiteConfig.d
# echo 'Set($AcceptedFiles, 'image/*,application/pdf,.csv');' > 20-RT_AttachmentRestrict.pm
</nowiki>

* '''Clear the Mason cache''' and restart everything. NOTE: This will vary depending on your installation of RT and OS/Distro, e.g. if you installed RT from source or using a package manager. Mine (on nginx and systemd) looks something like this:

<nowiki>
# service nginx stop
# systemctl stop rt-server.socket
# systemctl stop rt-server.service
# rm -rf /opt/rt6/var/mason_data/obj
# systemctl start rt-server.socket
# systemctl start rt-server.service
# service nginx start
</nowiki>

One-line version:
<nowiki>
# service nginx stop && systemctl stop rt-server.socket && systemctl stop rt-server.service && rm -rf /opt/rt6/var/mason_data/obj && systemctl start rt-server.socket && systemctl start rt-server.service && service nginx start
</nowiki>