security: restrict direct attachment access and upload file types#681

Merged

RussH merged 9 commits intoopencats:masterfrom

anonymoususer72041:security/attachments-access-and-upload

Feb 2, 2026

Commits on Dec 8, 2025

Deny direct HTTP access to attachments and require download via UI
anonymoususer72041
committed
Add server-side whitelist for allowed attachment upload types
anonymoususer72041
committed
Avoid static FileUtility access in attachment upload validation
anonymoususer72041
committed

Commits on Dec 16, 2025

Revert "Avoid static FileUtility access in attachment upload validation"
anonymoususer72041
committed

Commits on Jan 5, 2026

Commits on Jan 26, 2026

Merge branch 'master' into security/attachments-access-and-upload
RussH
committed

Commits on Jan 27, 2026

Escape attachment retrieval URLs in templates
anonymoususer72041
committed