From 805ee8403c4fc963dc6413a62f5e68dc6636dd69 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Thu, 26 Mar 2026 10:00:45 +0530
Subject: [PATCH] refactor: move config to application.rb

---
 config/application.rb                 |  6 ++++++
 config/initializers/active_storage.rb | 15 ---------------
 2 files changed, 6 insertions(+), 15 deletions(-)
 delete mode 100644 config/initializers/active_storage.rb

diff --git a/config/application.rb b/config/application.rb
index aa150794a..f0a10744b 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -69,6 +69,12 @@ module Chatwoot
     # Disable PDF/video preview generation as we don't use them
     config.active_storage.previewers = []
 
+    # Restrict content types served inline to prevent XSS via uploaded files (e.g. PDFs with embedded JavaScript).
+    config.active_storage.content_types_allowed_inline = %w[
+      image/png image/gif image/jpeg image/tiff image/vnd.adobe.photoshop
+      image/vnd.microsoft.icon image/webp image/avif image/heic image/heif
+    ]
+
     # Active Record Encryption configuration
     # Required for MFA/2FA features - skip if not using encryption
     if ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'].present?
diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
deleted file mode 100644
index d2581f78a..000000000
--- a/config/initializers/active_storage.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-# Restrict content types served inline to prevent XSS via uploaded files.
-# PDFs with embedded JavaScript can execute in-browser when served with
-# Content-Disposition: inline. Force them to download instead.
-Rails.application.config.active_storage.content_types_allowed_inline = %w[
-  image/png
-  image/gif
-  image/jpeg
-  image/tiff
-  image/vnd.adobe.photoshop
-  image/vnd.microsoft.icon
-  image/webp
-  image/avif
-  image/heic
-  image/heif
-]