File upload rules are the platform-wide constraints applied to every file that enters the system — maximum size, allowed types, filename normalisation, virus scanning, where the bytes go. Configuring them tightly keeps you safe from a long list of common problems.
Rules You Can Set
- Maximum file size — global default plus per-upload-field overrides.
- Allowed extensions — whitelist (preferred).
- Blocked extensions — blacklist for legacy reasons.
- MIME type verification — checks the file's magic bytes match the claimed type; defeats simple extension spoofing.
- Virus scan — runs ClamAV (or another configured scanner) on every upload.
- Filename sanitisation — normalise spaces, strip directory traversal, transliterate non-ASCII.
- Maximum dimensions for images — auto-resize anything bigger.
Recommended Defaults
- Max file size: 25MB for general purposes, lower (e.g. 5MB) for end-user-facing forms, higher (250MB) for staff-only document libraries.
- Allowed extensions: PDF, DOCX, XLSX, PNG, JPG, GIF, WEBP, MP4. Add as needed.
- MIME verification: on.
- Virus scan: on for any upload exposed beyond the originating user.
- Filename sanitisation: spaces → underscores, normalise unicode, strip path separators.
Worked Examples
- Resume submissions: Allow only PDF and DOCX, 10MB max, virus-scan, store in a private path.
- Photo uploads: Allow PNG/JPG/WEBP, 8MB max, auto-resize to 4096×4096, store in public CDN-backed path.
- Internal document library: Allow any of a broad set, 250MB max, sign URLs, index extracted text.
- Profile avatars: Allow only PNG/JPG, 2MB max, auto-crop to 512×512 square.
Warning: Never accept.exe,.bat,.cmd,.scror.jswithout a clear-eyed reason. They're the easiest path to delivering malware to other users.