[ImageUploadSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
Which uploaded files are accepted as images: the image datatype (edit form, upload module, rich text editor upload, AJAX uploader, WebDAV, imports) and the package thumbnails. The type is read from the file's content with PHP's fileinfo extension, not from its name, and must be on AllowedMIMETypes[]. A refused file is not stored. Without fileinfo the type comes from getimagesize() (or the file name) and one warning is logged per process.
File
settings/image.ini; override it in settings/override/image.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| ValidateMIMEType | enabled | enabled (default) or disabled. disabled only checks that the file is an image by getimagesize() or its name, as before the allow-list. |
| AllowedMIMETypes[] | image/jpeg; image/png; image/gif; image/webp; image/avif; image/tiff; image/bmp; image/svg+xml | The accepted types. SVG (image/svg+xml, .svg and .svgz) is accepted because it is sanitized on upload (SanitizeSVG below): only the SVG elements and attributes known to be safe are stored, without script, event attributes, foreignObject or external references. Every alias of an SVG is the sanitized file itself; it is never scaled. Serve the files with the headers in doc/eng-us/bc/6.0/svg-images.md. Remove the line to refuse SVG. |
| SanitizeSVG | enabled | enabled (default) or disabled. enabled: an SVG image is stored as the output of the SVG sanitizer (expSvgSanitizer); a file it cannot read, or in which nothing safe remains, is refused. disabled: SVG is refused, whatever AllowedMIMETypes[] says, so an SVG is never stored unsanitized. |
See also
Generated example: image.ini [ImageUploadSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/image.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment