Attachment file type is not allowed

[gravelfreeman]

Seems like I cannot attach my scripts 🥲

[timothepoznanski]

You're right, and this is fixed for the next release.

The blocklist dates back to a time when the data volume still lived inside the web root, so a .php attachment on disk could actually be executed by the server. That stopped being true with the docroot split in 6.81.0: data/ now sits outside the served directory, nginx denies it explicitly, and attachments only leave through PHP with X-Content-Type-Options: nosniff and Content-Disposition: attachment. What was left was a single list mixing two very different risks.

It is now split in two. File types a web server could execute (.php, .phtml, .phar, .asp, .aspx, .jsp, .cgi, .shtml) stay refused unconditionally, because self-hosted setups put all sorts of things in front of the volume. Everything else (.exe, .dll, .so, .bat, .cmd, .ps1, .sh, .py, .rb, .jar, ...) can only run on the machine of whoever downloads it, which on a personal instance is you, so it is now unlockable: an administrator turns on Settings > Admin Tools > Script and executable attachments and the whole instance can attach scripts. It is off by default, and the toggle is instance-wide rather than per account because on a shared instance those files become downloadable by everyone the notes are shared with, so the decision belongs to whoever runs the server. There is also a POZNOTE_ALLOW_EXECUTABLE_ATTACHMENTS environment variable for people who configure everything from their compose file.

The error message also got fixed. It used to say only "Attachment file type is not allowed", which told you nothing. It now names the refused type and where to lift it, and a non-admin user is told to ask an administrator rather than sent hunting through their own settings.

Thanks for reporting it. 😊