RestrictAttachments

Restricting Attachments in RT

Existing Attachment Restrictions

RT has existing config options to set a maximum file size for attachments, and if files exceeding this size limit should be truncated or dropped.

See config options:

• MaxAttachmentSize
• TruncateLongAttachments
• DropLongAttachments

Restricting attachment types

RT (as of 6.0.2) does not currently have a way to restrict attachments only to specific types, and there is no easy way to disable all attachments.

There are two methods to customise RT to restrict file attachments, depending on where you need to restrict:

1. Restrict which file types can be uploaded via the web interface (When users upload attachments)
2. Add a back-end overlay which restricts which attachment types will be stored globally, including via email, or any transaction involving attachments.

1. Restricting via RT Web Interface

RT uses the JavaScript library Dropzone in the web UI to handle file uploads.

Dropzone has an option acceptedFiles to limit the file type and/or extensions accepted.

This checks the file's MIME type or extension against this list. This is a comma separated list of MIME types or file extensions, e.g., The following would allow all image files, any file with MIME type application/pdf, and any file with extension .csv. All other file types will be rejected:

acceptedFiles: image/*,application/pdf,.csv

Implementing in RT (6.x and possibly older)

• Install local modified version of AddAttachments Mason template. From your RT directory, e.g. (/opt/rt6)

 # cd /opt/rt6
 # mkdir -p local/html/Ticket/Elements
 # cd local/html/Ticket/Elements
 # wget https://gist.githubusercontent.com/listerr/4445b14adea8f801970ce7daf7d9613e/raw/83b93f6f3d410432b5d354a487278bea34b1e6d5/AddAttachments

• Add the following new RT config option to your RT_SiteConfig.d files, e.g.: /opt/rt6/etc/RT_SiteConfig.d/20-RT_AttachmentRestrict.pm :

 Set($AcceptedFiles, 'image/*,application/pdf,.csv');

• Clear the Mason cache and restart everything.

NOTE: This will vary depending on your installation of RT and OS/Distro, e.g. if you installed RT from source or using a package manager. Mine (on nginx and systemd) looks something like this:

 # service nginx stop 
 # systemctl stop rt-server.socket 
 # systemctl stop rt-server.service 
 # rm -rf /opt/rt6/var/mason_data/obj 
 # systemctl start rt-server.socket
 # systemctl start rt-server.service
 # service nginx start

One-line version:

# service nginx stop && systemctl stop rt-server.socket && systemctl stop rt-server.service && rm -rf /opt/rt6/var/mason_data/obj && systemctl start rt-server.socket && systemctl start rt-server.service && service nginx start

NOTES:

• RT has a config option, $PreferDropzone which is enabled by default. However, users can change this option in their preferences to disable Dropzone. This modified AddAttachments ignores the user preference setting to prevent users bypassing attachment restrictions by disabling Dropzone.

• You may need to check this template when there upgrading to new releases/updates of RT. The installed version is in share/html/Ticket/Elements/AddAttachments by default.

• This may be a little inflexible because it applies globally for all attachment uploads. It would need further modifications, for example, to apply only to some queues but not others, or to allow different restrictions depending on user or queue.

2. Restricting via RT back-end

Alternative method in the RT back-end. This will restrict all attachments received via email and the web interface.