groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-02-25 10:59:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Added documentation on ATTACHMENT_SHOW_HTML_FILES env

Browse source
This commit is contained in:
Jan Böhmer 2026-02-24 23:07:41 +01:00
parent 419b46e806
commit 4004cf9c88
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/configuration.md
View file

@ -86,6 +86,9 @@ bundled with Part-DB. Set `DATABASE_MYSQL_SSL_VERIFY_CERT` if you want to accept
* `ATTACHMENT_DOWNLOAD_BY_DEFAULT`: When this is set to 1, the "download external file" checkbox is checked by default * `ATTACHMENT_DOWNLOAD_BY_DEFAULT`: When this is set to 1, the "download external file" checkbox is checked by default
when adding a new attachment. Otherwise, it is unchecked by default. Use this if you wanna download all attachments when adding a new attachment. Otherwise, it is unchecked by default. Use this if you wanna download all attachments
locally by default. Attachment download is only possible, when `ALLOW_ATTACHMENT_DOWNLOADS` is set to 1. locally by default. Attachment download is only possible, when `ALLOW_ATTACHMENT_DOWNLOADS` is set to 1.
* `ATTACHMENT_SHOW_HTML_FILES`: When enabled, user uploaded HTML attachments can be viewed directly in the browser.
Many potential malicious functions are restricted, still this is a potential security risk and should only be enabled,
if you trust the users who can upload files. When set to 0, HTML files are rendered as plain text.
* `USE_GRAVATAR`: Set to `1` to use [gravatar.com](https://gravatar.com/) images for user avatars (as long as they have * `USE_GRAVATAR`: Set to `1` to use [gravatar.com](https://gravatar.com/) images for user avatars (as long as they have
not set their own picture). The users browsers have to download the pictures from a third-party (gravatar) server, so not set their own picture). The users browsers have to download the pictures from a third-party (gravatar) server, so
this might be a privacy risk. this might be a privacy risk.

2
src/Settings/SystemSettings/AttachmentsSettings.php
View file

@ -62,7 +62,7 @@ class AttachmentsSettings
#[SettingsParameter( #[SettingsParameter(
label: new TM("settings.system.attachments.showHTMLAttachments"), label: new TM("settings.system.attachments.showHTMLAttachments"),
description: new TM("settings.system.attachments.showHTMLAttachments.help"), description: new TM("settings.system.attachments.showHTMLAttachments.help"),
envVar: "bool:ATTACHMENT_SHOW_HTML", envVarMode: EnvVarMode::OVERWRITE envVar: "bool:ATTACHMENT_SHOW_HTML_FILES", envVarMode: EnvVarMode::OVERWRITE
)] )]
public bool $showHTMLAttachments = false; public bool $showHTMLAttachments = false;
} }