refactor: move config to application.rb

chore: don't allow pdf inline
2026-03-26 10:00:45 +05:30 · 2026-03-26 09:57:02 +05:30
1 changed files with 6 additions and 0 deletions
@@ -69,6 +69,12 @@ module Chatwoot
    # Disable PDF/video preview generation as we don't use them
    config.active_storage.previewers = []

+    # Restrict content types served inline to prevent XSS via uploaded files (e.g. PDFs with embedded JavaScript).
+    config.active_storage.content_types_allowed_inline = %w[
+      image/png image/gif image/jpeg image/tiff image/vnd.adobe.photoshop
+      image/vnd.microsoft.icon image/webp image/avif image/heic image/heif
+    ]
+
    # Active Record Encryption configuration
    # Required for MFA/2FA features - skip if not using encryption
    if ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'].present?
Author	SHA1	Message	Date
Shivam Mishra	805ee8403c	refactor: move config to application.rb	2026-03-26 10:00:45 +05:30
Shivam Mishra	a0abd167dc	chore: don't allow pdf inline	2026-03-26 09:57:02 +05:30