image.ini [ImageUploadSettings] #

The block [ImageUploadSettings] of settings/image.ini, with 3 setting(s).

Which uploaded files are accepted as images: the image datatype (edit form,
upload module, rich text editor upload, AJAX uploader, WebDAV, imports) and
the package thumbnails. The type is read from the file's content with PHP's
fileinfo extension, not from its name, and must be on AllowedMIMETypes[].
A refused file is not stored. Without fileinfo the type comes from
getimagesize() (or the file name) and one warning is logged per process.

Never edit settings/image.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/image.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/image.ini.append.php for one siteaccess,
• extension/<extension>/settings/image.ini.append.php in an extension (read when the extension is active).

ValidateMIMEType #

enabled (default) or disabled. disabled only checks that the file is an
image by getimagesize() or its name, as before the allow-list.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/image.ini.append.php
[ImageUploadSettings]
ValidateMIMEType=enabled
*/ ?>

AllowedMIMETypes #

The accepted types. SVG (image/svg+xml, .svg and .svgz) is accepted
because it is sanitized on upload (SanitizeSVG below): only the SVG
elements and attributes known to be safe are stored, without script, event
attributes, foreignObject or external references. Every alias of an SVG is
the sanitized file itself; it is never scaled. Serve the files with the
headers in doc/eng-us/bc/6.0/svg-images.md. Remove the line to refuse SVG.

Default: a list of 8: image/jpeg, image/png, image/gif, image/webp, image/avif, image/tiff, image/bmp, image/svg+xml.

<?php /* #?ini charset="utf-8"?
# settings/override/image.ini.append.php
[ImageUploadSettings]
# an empty "AllowedMIMETypes[]" first replaces the shipped list; without it the items are added
AllowedMIMETypes[]
AllowedMIMETypes[]=image/jpeg
AllowedMIMETypes[]=image/png
AllowedMIMETypes[]=image/gif
AllowedMIMETypes[]=image/webp
AllowedMIMETypes[]=image/avif
AllowedMIMETypes[]=image/tiff
AllowedMIMETypes[]=image/bmp
AllowedMIMETypes[]=image/svg+xml
*/ ?>

SanitizeSVG #

enabled (default) or disabled. enabled: an SVG image is stored as the
output of the SVG sanitizer (expSvgSanitizer); a file it cannot read, or in
which nothing safe remains, is refused. disabled: SVG is refused, whatever
AllowedMIMETypes[] says, so an SVG is never stored unsanitized.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/image.ini.append.php
[ImageUploadSettings]
SanitizeSVG=enabled
*/ ?>

Related #

• All blocks of image.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/image.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.