File Attachment Control

1. Create a view.
2. Drag the control onto the canvas. You can find the control in the Attachment section of the Toolbox.
3. Configure the rest of the properties as necessary.
4. Run the view.

Attachment Control File Type and Size

You can specify what types of files are allowed and restrict uploads to a size limit. See the Blacklist and Web.config file entries sections for information to consider when you specify file types and sizes which impact the behavior of the control.

Web.config Entries

You can find the web.config files in the following locations:
"%ProgramFiles%\K2\K2 smartforms Designer\web.config"
"%ProgramFiles%\K2\K2 smartforms Runtime\web.config"

The code sample below shows the Blacklist and MaxSize entries. You can change these values according to your business requirements.

<!--<add key="Forms.Designer.Controls.Attachment.Blacklist" value="ade,adp,app,asa,ashx,asmx,asp,aspx,bas,bat,cdx,cer,chm,class,cmd,cnt,com,config,cpl,crt,cs,csh,der,dll,exe,fxp,gadget,

grp,hlp,hpj,hta,htr,htw,ida,idc,idq,inf,ins,isp,its,its,jar,javascript,jscript,js,jse,json,ksh,lib,lnk,mad,maf,mag,mam,maq,

mar,mas,mat,mau,mav,maw,mcf,mda,mdb,mde,mdt,mdw,mdz,msc,msh,msh1,msh1xml,msh2,msh2xml,mshxml,msi,ms-one-stub,msp,mst,ocx,ops,pcd,pif,pl,plg,prf,prg,printer,ps,ps1,ps1xml,ps2,ps2xml,psc1,psc2,pst,pst,reg,reg,scf,scr,sct,sct,shb,

shs,shs,shtm,shtml,soap,stm,svc,sys,tmp,url,vb,vbe,vbs,vbscript,vxd,vscript,vsix,vsmacros,vsw,ws,wsc,wsf,wsh,xamlx,xnk" />-->

<!--<add key="Forms.Designer.Controls.Attachment.MaxSize" value="5120" />-->

• Blacklist - This is the global blacklist containing potentially dangerous and commonly-banned file types. You can update these to add or remove file types.
• MaxSize - The maximum size, in kilobytes (KB) of file uploads. The value of this entry is used to restrict all uploads. This size relates directly to the Max Size property of the File Attachment and Image Attachment controls. The default setting is 5120 KB. You can configure a certain size in the control's property, but this setting overrides the control's setting. Use the control's setting for further restricting upload size. If you want to increase the file upload size to 10 MB, for example, change the MaxSize entry in the web.config file to 10000 or 10 MB. Then, if you needed to further restrict upload sizes to 100 KB in an instance of the control, you would set that on the control.

These config file lines are commented by default but are enforced on the environment using default values. If you want to change the default values, uncomment the line and change its value.

Blacklist files

The following table is a list of blacklist file types. Files of these types cannot be uploaded to the K2 server using the control.

Extension	Description
ade	Access Project Extension (Microsoft).
adp	Access Project (Microsoft).
app	Executable Application.
asa	ASP declarations file.
ashx	ASP.NET Web handler file. Web handlers are software modules that handle raw HTTP requests received by ASP.NET.
asmx	ASP.NET Web Services source file.
asp	Active Server Page.
aspx	ASP.net.
bas	BASIC Source Code.
bat	Batch Processing.
cdx	Compound index.
cer	Internet Security Certificate File.
chm	Compiled HTML Help.
class	Java class file.
cmd	DOS CP/M Command File, Command File for Windows NT.
cnt	Help Contents file.
com	Command.
config	Configuration file.
cpl	Windows Control Panel Extension (Microsoft).
crt	Certificate File.
cs	C# code file.
csh	csh Script.
der	DER Encoded X509 Certificate File.
dll	Windows dynamic-link library.
exe	Executable File.
fxp	FoxPro Compiled Source (Microsoft).
gadget	Windows Vista gadget.
grp	SmarterMail group file.
hlp	Windows Help File.
hpj	Help project file.
hta	Hypertext Application.
htr	Script file.
htw	HTML document.
ida	Internet Information Services file.
idc	Internet database connector file.
idq	Internet data query file.
inf	Information or Setup File.
ins	IIS Internet Communications Settings (Microsoft).
isp	IIS Internet Service Provider Settings (Microsoft).
its	Internet Document Set, Internet Translation
jar	Java Archive.
javascript	JavaScript Source Code.
jscript	JavaScript Source Code.
js	JavaScript Source Code.
jse	JScript Encoded Script File.
json	JavaScript Object Notation file.
ksh	UNIX Shell Script.
lib	Windows static-link library.
lnk	Windows Shortcut File.
mad	Access Module Shortcut (Microsoft).
maf	Access (Microsoft).
mag	Access Diagram Shortcut (Microsoft).
mam	Access Macro Shortcut (Microsoft).
maq	Access Query Shortcut (Microsoft).
mar	Access Report Shortcut (Microsoft).
mas	Access Stored Procedures (Microsoft).
mat	Access Table Shortcut (Microsoft).
mau	Media Attachment Unit.
mav	Access View Shortcut (Microsoft).
maw	Access Data Access Page (Microsoft).
mcf	Multimedia Container Format.
mda	Access Add-in (Microsoft), MDA Access 2 Workgroup (Microsoft).
mdb	Access Application (Microsoft), MDB Access Database (Microsoft).
mde	Access MDE Database File (Microsoft).
mdt	Access Add-in Data (Microsoft).
mdw	Access Workgroup Information (Microsoft).
mdz	Access Wizard Template (Microsoft).
msc	Microsoft Management Console Snap-in Control File (Microsoft).
msh	Microsoft Shell.
msh1	Microsoft Shell.
msh1xml	Microsoft Shell.
msh2	Microsoft Shell.
msh2xml	Microsoft Shell.
mshxml	Microsoft Shell.
msi	Windows Installer File (Microsoft).
ms-one-stub	Microsoft OneNote stub.
msp	Windows Installer Update.
mst	Windows SDK Setup Transform Script.
ocx	Object Linking and Embedding (OLE) Control Extension.
ops	Office Profile Settings File.
pcd	Visual Test (Microsoft).
pif	Windows Program Information File (Microsoft).
pl	Perl script.
plg	Developer Studio Build Log.
prf	Windows System File.
prg	Program File.
printer	Printer file.
ps	Windows PowerShell.
ps1	Windows PowerShell.
ps1xml	Windows PowerShell.
ps2	Windows PowerShell.
ps2xml	Windows PowerShell.
psc1	Windows PowerShell.
psc2	Windows PowerShell.
pst	MS Exchange Address Book File, Outlook Personal Folder File (Microsoft).
reg	Registration entries.
scf	Windows Explorer command file.
scr	Windows Screen Saver.
sct	Windows Script Component, Foxpro Screen (Microsoft).
shb	Windows Shortcut into a Document.
shs	Shell Scrap Object File.
shtm	HTML file that contains server-side directives.
shtml	HTML file that contains server-side directives.
soap	Simple Object Access Protocol file.
stm	HTML file that contains server-side directives.
svc	Windows Communication Foundation (WCF) service file.
sys	Real mode device driver.
tmp	Temporary File or Folder.
url	Internet Location.
vb	VBScript File or Any Visual Basic Source.
vbe	VBScript Encoded Script File.
vbs	VBScript Script File, Visual Basic for Applications Script.
vbscript	VBScript Script File, Visual Basic for Applications Script.
vxd	Virtual document exchange.
vscript	VBScript Script File, Visual Basic for Applications Script.
vsix	Visual Studio Extension.
vsmacros	Visual Studio .NET Binary-based Macro Project (Microsoft).
vsw	Visio Workspace File (Microsoft).
ws	Windows Script File.
wsc	Windows Script Component.
wsf	Windows Script File.
wsh	Windows Script Host Settings File.
xamlx	Visual Studio Workflow service file.
xnk	Exchange Public Folder Shortcut.

You can find the control in the Attachment section of the Toolbox.

The control interacts with other controls through rules. When you bind properties between different controls, you can use the data to populate properties or set values. Use the following examples for when to use the control with other controls through rules:

• Set a control’s properties: You can configure the settable properties such as file types and sizes of the control with this action
• Show/Hide: The Visible property allows you to show or hide the control through rules
• Enable/Disable: The Enabled property allows you to enable or disable the control through rules

• The global maximum file and image size is controlled by the MaxRequestLength setting in the web.config file in the system.web section

  <httpRuntime MaxRequestLength="16384" />

• When you have a form with many views and multiple states the form rules might not show after you add an additional state. This happens when the form definition increases and exceeds the MaxRequestLength setting in the web.config. Edit this setting if you want to be able to have larger form definitions. The default maximum value is set as 16384 KB. See the following link for more details about the MaxRequestLength setting: HttpRuntimeSection.MaxRequestLength Property (Microsoft)
  You can find the web.config files in the following locations:
  "%ProgramFiles%\K2\K2 smartforms Designer"
  "%ProgramFiles%\K2\K2 smartforms Runtime"
• The runtime MaxRequestLength setting in the web.config file overrides the MaxSize setting in the web.config file and the Max Size control property setting

• Request filtering is a feature that can be configured in Internet Information Services (IIS)

  <system.webServer>

  <security>

  <requestFiltering>

  <requestLimits maxAllowedContentLength="1073741824"></requestLimits>

  </requestFiltering>

  </security>

  </system.webServer>

  See the following link for more detail: Request Limits <requestLimits> (Microsoft)

  If you enable this setting on an environment, it is important to note that the minimum value of the MaxRequestLength setting, the requestFiltering setting and the MaxSize setting limits the attachments to upload.

• You can blacklist files with no extension by adding two commas in the blacklist with or without spaces, for example:
  
  
  
• The Enter key does not open a file browse dialog in Internet Explorer
• When you configure a form for anonymous access, you cannot upload or download files with the File Attachment control. You should carefully consider and evaluate the impact of allowing file uploads and downloads with anonymous access forms, since doing so may be considered a security vulnerability. User credentials and authentication are not required for anonymous access forms and therefore any files uploaded or downloaded with such forms can be performed by anyone that can access the form, without having to provide credentials. To allow file uploads and downloads for anonymous access forms, you can add the following configuration settings to the web.config files of the SmartForms websites. Find the websites here:
  [Install Directory]\K2\K2 smartforms Designer
  [Install Directory]\K2\K2 smartforms Runtime
  Add the following setting to the <appSettings> section of the configuration files listed above:
  <add key="Forms.Controls.File.AllowAnonymousAccess" value="true" /> (Applicable to the File Attachment control)
  <add key="Forms.Controls.Image.AllowAnonymousAccess" value="true" /> (Applicable to the Picture and Image Attachment controls)
  You must set the value to true to allow the controls to function when you access them through anonymous access forms. If you do not add this setting or if you set it to false, the controls do not work on anonymous access forms, namely errors occur when uploading or downloading files, and image thumbnails may not display. This configuration applies to the entire site and all anonymous access forms. It is not possible to configure security for the File Attachment, Image and Picker controls for individual anonymous forms.
• The File Attachment control does not allow uploading of certain types of files, including but not limited to:
  • .cpl
  • .vxd
  • .cmd
  • .pif
  • .com
  • .msi
  • .scr
  • .ps
  • .wsh
  • .ocx
  • .dll
  • .bat
  • .exe
  • .vbs
  • .vbe
  • .vb
  • .aspx
  • .vbscript
  • .vscript
  • .javascript
  • .jscript
  • .js