Policy reference

A policy file is XML in richtexteditor/config. Three are included: guest.config (browse only), default.config (members: upload and create folders) and admin.config (everything). Your page chooses one per user; nothing in a browser request can change or widen it.

<rteconfig>
  <security name="AllowUpload">true</security>              <!-- global -->
  <category for="Gallery,Image">                             <!-- one or more categories -->
    <security name="Extensions">*.jpg,*.png</security>
    <storage id="default">
      <security name="StoragePath">~/uploads/images</security>
      <security name="StorageName">Images</security>
    </storage>
  </category>
</rteconfig>

A setting is looked up in the storage, then the category, then the global settings, then the default below. SetSecurity() overrides any of them from your page.

Settings

Setting	Default	Meaning
`AllowUpload`	`false`	Upload files.
`AllowCopyFile`	`false`	Kept for old files; not used.
`AllowMoveFile`	`false`	Kept for old files; not used.
`AllowRenameFile`	`false`	Rename files.
`AllowDeleteFile`	`false`	Delete files.
`AllowOverride`	`false`	Replace a file of the same name. Without it, a new upload gets a numbered name.
`AllowCreateFolder`	`false`	Create folders.
`AllowCopyFolder`	`false`	Kept for old files; not used.
`AllowMoveFolder`	`false`	Kept for old files; not used.
`AllowRenameFolder`	`false`	Rename folders.
`AllowDeleteFolder`	`false`	Delete folders with their content.
`MaxFileSize`	`1024`	Largest upload, in KB.
`MaxFolderSize`	`102400`	Largest total size of a storage, in KB.
`LargeImageMode`	`resize`	Images larger than MaxImageWidth x MaxImageHeight: `resize` scales them down, `deny` refuses them, `allow` keeps them.
`MaxImageWidth`	`0`	Pixels; 0 = no limit.
`MaxImageHeight`	`0`	Pixels; 0 = no limit.
`MaxImagePixels`	`40000000`	Largest image (width x height) that is decoded at all; protects the server's memory.
`StripImageMetadata`	`true`	Save JPEG, PNG and WebP again without EXIF, GPS, XMP or ICC data.
`FilePattern`	`^[a-zA-Z0-9\._\-\s\[\]\x{007F}-\x{FFFF}]+$`	Regular expression every file name must match. The previous version's \uXXXX form is understood.
`FolderPattern`	`^[a-zA-Z0-9\._\-\s\[\]\x{007F}-\x{FFFF}]+$`	Regular expression every folder name must match.
`StoragePath`	`~/uploads`	Folder of a storage. `~/` is the web root; a path outside it also needs `StorageUrl`.
`Extensions`	(none)	Allowed file types of a category, as `.jpg,.png`. Server and active-content types are refused even if listed: php, php3, php4, php5, php7, php8, phtml, pht, phar, phps, inc, asp and more.
`StorageName`	(category) files	The name the gallery shows for the storage.
`StorageUrl`	(from StoragePath)	Public URL of a storage outside the web root.
`TagBlackList`, `AttrBlackList`, `StyleBlackList`	(none)	Tags, attributes and CSS properties removed by the server-side cleaning, on top of its own rules.

Policy reference

Settings

Categories