Upload Rules
Several settings decide what the platform accepts when somebody uploads a file.
Where to find it
Architect Panel → Configuration:
- Site Settings — the File Uploads and Audio/Video Conversion groups
Architect Panel → Data:
- File Stores — the stores themselves, and View File Store on a row
- Large Uploads — in-progress and stalled upload sessions
- File Import Routines — watched sources and their mappings
The settings
- Allow files without filenames.
- Allow files without extensions.
- Replace spaces in filenames.
- Force simple file names.
- Index document contents.
- Public and private upload paths.
Three of these are conveniences. The rest decide whether a hostile upload is a problem.
File scopes constrain the types
Separately from these settings, named scopes list the file types allowed in a particular context. That is where "images only" or "documents only" is expressed, per place rather than for the whole installation.
Use them. An upload field accepting anything is an upload field somebody will use for anything.
Uploads are user-supplied content
The framing that matters. A file is data from somebody you do not control, with a name they chose, in a format they chose. Treat every upload accordingly:
- Never trust the name.
- Never trust the declared type.
- Never serve it back from somewhere it could execute.
Private by default
Anything that is not deliberately public belongs on the private path, served through the platform so permissions apply. A file placed in a public directory is a file with a guessable address and no access control.
Keep names simple
The safe-name setting exists because filenames arrive containing anything a user’s device allowed — accents, emoji, path separators, control characters. Simplifying them avoids problems across operating systems, in URLs, and in downloads.
Set size limits realistically
Large enough for the documents people genuinely need to send, small enough that a mistake is not a storage incident. And remember that large files have their own chunked path — the limit that matters is often not the one you think.
Think about what accumulates
Uploads only grow. Attachments on records that were closed years ago, drafts, duplicates. Include files in whatever retention thinking covers your records, or storage becomes a surprise.
Test with an awkward file
A name with spaces and an accent, no extension, and a type your scope should refuse. Those three cover most upload behaviour, and they take a minute.
Worked example
An organisation restricts each upload field with a file scope, keeps everything on the private path except its public asset store, and forces simple names. A test with an unnamed, extensionless file confirmed it was refused rather than stored under a generated name nobody could find.
Recommendations
- Use file scopes per field, not one global rule.
- Private path by default.
- Force simple names.
- Test with deliberately awkward files.