Is there an existing issue for this?
Summary
Feature Request: Expand Allowed Attachment File Types & Improve MIME Type Validation
Description
Currently, the self-hosted version of Plane implements a very strict whitelist for file uploads via the ATTACHMENT_MIME_TYPES setting in plane/settings/common.py.
While this provides security, it results in a poor user experience because:
- Many standard file types are missing from the list.
- Different operating systems and browsers often send slightly different MIME type strings for the exact same file extension (e.g.,
.md sent as text/plain or text/x-markdown, .csv sent as application/csv).
When a user tries to upload a perfectly safe, standard file, if their browser's inferred MIME type doesn't perfectly match Plane's hardcoded list, they receive a generic {"error": "Invalid file type.", "status": False} response.
Proposed Solution
We propose two improvements to the attachment handling system:
1. Expand the ATTACHMENT_MIME_TYPES whitelist:
Include common aliases for already supported file types to prevent valid files from being rejected simply because the user's browser sent a variant MIME type.
- Markdown: Add
text/x-markdown, application/markdown
- CSV: Add
application/csv, text/comma-separated-values
2. Make allowed file types configurable (Optional but Recommended):
Instead of entirely hardcoding ATTACHMENT_MIME_TYPES in common.py, allow workspace administrators to define or extend allowed file extensions/MIME types via an environment variable (e.g., EXTRA_ALLOWED_MIME_TYPES="text/csv,application/csv"). This gives self-hosted users the flexibility to support specific workflows without needing to modify the core Python codebase.
Use Case
Users frequently attempt to attach standard developer or business files (like Markdown documentation or CSV data exports) to issues. Currently, these fail silently in the UI or show an "Invalid file type" toast, leading users to believe the platform is broken when it is simply a strict MIME matching issue.
Environment
- Deployment: Self-Hosted (Docker)
- Component: API backend (
plane/settings/common.py)
Why should this be worked on?
This should be worked on because it creates a frustrating and confusing user experience. When users attempt to upload perfectly standard, safe files (like .csv data exports or .md documentation) to an issue, the system rejects them with a generic "Invalid file type" error.
Because the backend strictly checks a hardcoded list of MIME types, it fails to account for the reality that different operating systems and browsers (Chrome, Edge, Firefox, Safari) send different MIME strings for the exact same file extension. Expanding the allowed list or making it configurable prevents valid workflows from being blocked and reduces the impression that the platform's upload feature is broken.
Is there an existing issue for this?
Summary
Feature Request: Expand Allowed Attachment File Types & Improve MIME Type Validation
Description
Currently, the self-hosted version of Plane implements a very strict whitelist for file uploads via the
ATTACHMENT_MIME_TYPESsetting inplane/settings/common.py.While this provides security, it results in a poor user experience because:
.mdsent astext/plainortext/x-markdown,.csvsent asapplication/csv).When a user tries to upload a perfectly safe, standard file, if their browser's inferred MIME type doesn't perfectly match Plane's hardcoded list, they receive a generic
{"error": "Invalid file type.", "status": False}response.Proposed Solution
We propose two improvements to the attachment handling system:
1. Expand the
ATTACHMENT_MIME_TYPESwhitelist:Include common aliases for already supported file types to prevent valid files from being rejected simply because the user's browser sent a variant MIME type.
text/x-markdown,application/markdownapplication/csv,text/comma-separated-values2. Make allowed file types configurable (Optional but Recommended):
Instead of entirely hardcoding
ATTACHMENT_MIME_TYPESincommon.py, allow workspace administrators to define or extend allowed file extensions/MIME types via an environment variable (e.g.,EXTRA_ALLOWED_MIME_TYPES="text/csv,application/csv"). This gives self-hosted users the flexibility to support specific workflows without needing to modify the core Python codebase.Use Case
Users frequently attempt to attach standard developer or business files (like Markdown documentation or CSV data exports) to issues. Currently, these fail silently in the UI or show an "Invalid file type" toast, leading users to believe the platform is broken when it is simply a strict MIME matching issue.
Environment
plane/settings/common.py)Why should this be worked on?
This should be worked on because it creates a frustrating and confusing user experience. When users attempt to upload perfectly standard, safe files (like
.csvdata exports or.mddocumentation) to an issue, the system rejects them with a generic "Invalid file type" error.Because the backend strictly checks a hardcoded list of MIME types, it fails to account for the reality that different operating systems and browsers (Chrome, Edge, Firefox, Safari) send different MIME strings for the exact same file extension. Expanding the allowed list or making it configurable prevents valid workflows from being blocked and reduces the impression that the platform's upload feature is broken.