File Upload

Purpose

The File Upload page in the Admin Console allows you to manage how users can upload files in your Appian environment.

Access

To access the File Upload page, go to the Admin Console. Then, in the left navigation menu, under System, click File Upload.

Settings

The File Upload page allows customers to manage the following settings:

• Enable Real-Time Virus Scanning (Cloud Only): When enabled, all files under 25MB that are uploaded in the following places will be scanned immediately upon upload: Tempo News, Social Tasks, interfaces in all locations (Tempo, Sites, and Embedded interfaces), the Admin Console, and the Appian Designer. Files found to contain viruses are logged in the blocked files audit log.
• Block files with the specified extensions: If chosen, Appian will block any file with an extension listed in the Extensions to Block field. Choosing this option allows you to disable the feature by leaving the Extensions to Block input blank.
  • Extensions to Block: A case-insensitive list of extensions to block separated by whitespace (spaces, tabs, or new lines). The values provided are matched exactly as written, case excluded. For example, specifying "jpg" will not block "jpeg" files.
  • Block files without an extension, for example, "my_file." and "my_file": When enabled, files without an extension will be blocked. If file type verification is enabled, this field will be checked and disabled because files without an extension do not have a valid type.
• Only allow files with the specified extensions: If chosen, Appian will block any file with an extension not listed in the Extensions to Allow field.
  • Extensions to Allow: A case-insensitive list of extensions to exclusively allow separated by whitespace (spaces, tabs, or new lines). The values provided are matched exactly as written, case excluded. For example, specifying "jpg" will not allow "jpeg" files.
  • Allow files without an extension, for example, "my_file." and "my_file": When enabled, files without an extension will be allowed. If file type verification is enabled, this field will be unchecked and disabled because files without an extension do not have a valid type.
• Block any file with an extension that does not match the underlying file type: When enabled, Appian will analyze the file contents of uploaded files to determine the type of the file. If Appian successfully identifies the file type and the type does not match the extension, the file will be blocked regardless of the configured extension list. If the underlying file type or the file type associated with the extension cannot be determined, the extension will be trusted and checked against the extension list above.
• Apply above settings to contents of compressed files: If checked, Appian will inspect the contents of .zip and similar files and block if they violate the rules above

Using file type verification effectively

File type verification can be toggled on and off through the checkbox labeled "Block any file with an extension that does not match the underlying file type". To fully leverage this powerful feature, we recommend enabling it in coordination with a list of extensions to allow rather than a list of extensions to block. We recommend this for two reasons:

1. It is more secure. It is very difficult to enumerate all possible extensions that could be dangerous to your users.
2. They work well together. If Appian finds an extension or file type that it does not recognize, it assumes that the file has a valid extension. The purpose of this feature is to allow proprietary file extensions that may not be in our database through. It does mean, however, that users can rename files to a nonsense file extension, like "asdf", to bypass the list of blocked extensions and file type verification. A list of exclusively permitted file extensions avoids this issue.

Feedback