File Uploads

File upload rules are the platform-wide constraints applied to every file that enters the system — maximum size, allowed types, filename normalisation, virus scanning, where the bytes go. Configuring them tightly keeps you safe from a long list of common problems.

Rules You Can Set

• Maximum file size — global default plus per-upload-field overrides.
• Allowed extensions — whitelist (preferred).
• Blocked extensions — blacklist for legacy reasons.
• MIME type verification — checks the file's magic bytes match the claimed type; defeats simple extension spoofing.
• Virus scan — runs ClamAV (or another configured scanner) on every upload.
• Filename sanitisation — normalise spaces, strip directory traversal, transliterate non-ASCII.
• Maximum dimensions for images — auto-resize anything bigger.

Recommended Defaults

• Max file size: 25MB for general purposes, lower (e.g. 5MB) for end-user-facing forms, higher (250MB) for staff-only document libraries.
• Allowed extensions: PDF, DOCX, XLSX, PNG, JPG, GIF, WEBP, MP4. Add as needed.
• MIME verification: on.
• Virus scan: on for any upload exposed beyond the originating user.
• Filename sanitisation: spaces → underscores, normalise unicode, strip path separators.

Worked Examples

• Resume submissions: Allow only PDF and DOCX, 10MB max, virus-scan, store in a private path.
• Photo uploads: Allow PNG/JPG/WEBP, 8MB max, auto-resize to 4096×4096, store in public CDN-backed path.
• Internal document library: Allow any of a broad set, 250MB max, sign URLs, index extracted text.
• Profile avatars: Allow only PNG/JPG, 2MB max, auto-crop to 512×512 square.

Warning: Never accept .exe, .bat, .cmd, .scr or .js without a clear-eyed reason. They're the easiest path to delivering malware to other users.

Some sources upload files without a filename or extension — a curl POST with raw bytes, a webhook delivering a screenshot, a sensor pushing telemetry. By default ActiveManage rejects these. This article shows when and how to relax that.

Why It's Off by Default

• Anonymous bytes are a common attack vector — uploaders rely on filename to guess type, and extensionless files bypass that.
• Browsers cannot identify what to do with extensionless downloads — they prompt the user, which is confusing.
• The MIME-type sniff catches most well-formed files but not all.

When to Allow

• API uploads with explicit type header: Caller sends Content-Type: image/png and raw bytes — trust the header for typed callers (your own services).
• Programmatic webhook: Vendor's webhook sends data plus a separate metadata field with the original filename.
• Sensor / IoT data: Binary blobs from a fleet of devices; the caller is implicitly trusted.

How to Allow

1. Open Site Settings → Files → Upload Rules.
2. Toggle Allow uploads with no filename/extension on.
3. Pick what to do:
   • Auto-generate filename as UUID, with extension inferred from MIME type (if detectable).
   • Reject uploads where MIME detection also fails.
4. Optionally limit this allowance to specific upload endpoints (e.g. API only, not web form).

Worked Examples

• Telemetry endpoint: Sensors upload raw binary; the API receiver auto-names them {uuid}.bin and tags with sensor ID.
• Webhook image relay: Vendor sends image/png in body; saved as {uuid}.png.
• Internal upload script: Operations team scripts upload anonymous files via API; rule allowed only for that API key's scope.

Spaces in filenames are valid almost everywhere but cause persistent friction — URLs need encoding, command-line tools choke, some HTTP middleware mangles them. ActiveManage offers a built-in option to replace spaces at upload time so downstream tooling never trips.

Replacement Choices

• Underscore (_): Most common. Reads fine, machine-friendly.
• Hyphen (-): SEO-friendly for files served directly from URLs.
• Nothing: Concatenate without separator. Compact but unreadable; rare choice.
• Off: Keep spaces as-is. Default. Works for most modern systems but exposes any tooling weaknesses.

When to Replace

• Files served directly from public URLs — hyphens are best for SEO.
• Files passed through legacy systems that don't handle spaces well.
• Files that will be processed by command-line scripts that need quoting otherwise.
• Anywhere you suspect URL-encoding will introduce inconsistency.

Worked Examples

• Media library: Replace with hyphens so URLs like /files/my-product-photo.jpg are clean.
• Internal document store: Replace with underscores; users still see the original filename in the UI (the platform preserves the original in a separate field for display).
• API-only uploads: Off — API callers handle their own naming.

Note: The original filename is always preserved in the database as a display label. Only the stored-file's filename is normalised. Users see the friendly name in the UI even if the backing file is renamed.

Force Simple File Names goes beyond replacing spaces — it normalises every filename to a strict ASCII-safe slug. Useful when files are exposed via URLs, accessed from legacy systems, or stored on filesystems that struggle with unicode.

What It Does

When the setting is on, every upload's filename is:

• Transliterated from unicode to ASCII (é → e, ñ → n, ß → ss).
• Lower-cased (optional).
• Stripped of special characters except alphanumerics, dot and the chosen separator.
• Spaces and underscores collapsed to a single separator (typically hyphen).
• Truncated to a max length (typically 100 characters).
• Suffixed with a short hash if a collision would occur in the destination directory.

Configuration Options

• Case: Preserve, lower-case, or upper-case.
• Separator: Hyphen (URL-friendly) or underscore.
• Max length: Default 100; longer is fine for internal-only files.
• Transliteration target: ASCII (most compatible) or Latin-1.

Worked Examples

• Public CDN: All filenames lower-case, hyphen separator, max 80 chars. URLs are clean and predictable.
• FTP integration with legacy ERP: ASCII-only, upper-case, no special characters at all. Compatible with mainframe filename rules.
• End-user file library: Off — users want to see their original filenames in the file picker.

Tip: Always keep the original filename in a display field. The user uploaded “Photo of my Dog 🐕.jpg” and expects to see that exact text — they don't care that the backing storage uses photo-of-my-dog.jpg.