File Attachment Control

1. Create a view.
2. Drag the control onto the canvas. You can find the control in the Attachment section of the Toolbox.
3. Configure the rest of the properties as necessary.
4. Run the
   view.

Attachment Control File Type and Size

You can specify what types of files are allowed and restrict uploads to a size limit. See the Blacklist and Web.config file entries sections for information to consider when you specify file types and sizes which impact the behavior of the control.

Web.config Entries

You can find the web.config files in the following locations:
"%ProgramFiles%\K2\K2 smartforms Designer\web.config"
"%ProgramFiles%\K2\K2 smartforms Runtime\web.config"

The code sample below shows the Blacklist and MaxSize entries. You can change these values according to your business requirements. These settings are configured on the Tenant infrastructure. If you need to change these settings, contact Nintex Customer Central portal.

Copy

Blacklist and MaxSize entries

1
2
3
4
5
<!--<add key="Forms.Designer.Controls.Attachment.Blacklist" 
                                value="ade,adp,app,asa,ashx,asmx,asp,aspx,bas,bat,cdx,cer,chm,class,cmd,cnt,com,config,cpl,crt,cs,csh,der,dll,exe,fxp,gadget,grp,hlp,hpj,hta,htr,htw,ida,idc,idq,inf,ins,isp,its,its,jar,javascript,jscript,js,jse,json,ksh,lib,lnk,mad,maf,mag,mam,maq,mar,mas,mat,mau,mav,maw,mcf,mda,mdb,mde,mdt,mdw,mdz,msc,msh,msh1,msh1xml,msh2,msh2xml,mshxml,msi,ms-one-stub,msp,mst,ocx,ops,pcd,pif,pl,plg,prf,prg,printer,ps,ps1,ps1xml,ps2,ps2xml,psc1,psc2,pst,pst,reg,reg,scf,scr,sct,sct,shb,shs,shs,shtm,shtml,soap,stm,svc,sys,tmp,url,vb,vbe,vbs,vbscript,vxd,vscript,vsix,vsmacros,vsw,ws,wsc,wsf,wsh,xamlx,xnk" />-->

                                <!--<add key="Forms.Designer.Controls.Attachment.MaxSize" value="5120" />-->
                            

• Blacklist - This is the global blacklist containing potentially dangerous and commonly-banned file types. You can update these to add or remove file types.
• MaxSize - The maximum size, in kilobytes (KB) of file uploads. The value of this entry is used to restrict all uploads. This size relates directly to the Max Size property of the File Attachment and Image Attachment controls. The default setting is 5120 (KB), with a maximum of 50000 (KB). You can configure a certain size in the control's property, but this setting overrides the control's setting. Use the control's setting for further restricting upload size. If you want to increase the file upload size to 10 MB, for example, change the MaxSize entry in the web.config file to 10000 (KB). Then, if you needed to further restrict upload sizes to 100 KB in an instance of the control, you would set that on the control. The value for the MaxSize entry cannot contain units such as KB or MB. It must be a numeric value only, which infers KB.

• These config file lines are commented by default but are enforced on the environment using default values. If you want to change the default values, uncomment the line and change its value.
• The MaxSize entry in the web.config file is limited to 50000 or 50 MB.

Blacklist files

The following table is a list of blacklist file types. Files of these types cannot be uploaded to the server using the control.

Extension	Description
ade	Access Project Extension (Microsoft).
adp	Access Project (Microsoft).
app	Executable Application.
asa	ASP declarations file.
ashx	ASP.NET Web handler file. Web handlers are software modules that handle raw HTTP requests received by ASP.NET.
asmx	ASP.NET Web Services source file.
asp	Active Server Page.
aspx	ASP.net.
bas	BASIC Source Code.
bat	Batch Processing.
cdx	Compound index.
cer	Internet Security Certificate File.
chm	Compiled HTML Help.
class	Java class file.
cmd	DOS CP/M Command File, Command File for Windows NT.
cnt	Help Contents file.
com	Command.
config	Configuration file.
cpl	Windows Control Panel Extension (Microsoft).
crt	Certificate File.
cs	C# code file.
csh	csh Script.
der	DER Encoded X509 Certificate File.
dll	Windows dynamic-link library.
exe	Executable File.
fxp	FoxPro Compiled Source (Microsoft).
gadget	Windows Vista gadget.
grp	SmarterMail group file.
hlp	Windows Help File.
hpj	Help project file.
hta	Hypertext Application.
htr	Script file.
htw	HTML document.
ida	Internet Information Services file.
idc	Internet database connector file.
idq	Internet data query file.
inf	Information or Setup File.
ins	IIS Internet Communications Settings (Microsoft).
isp	IIS Internet Service Provider Settings (Microsoft).
its	Internet Document Set, Internet Translation
jar	Java Archive.
javascript	JavaScript Source Code.
jscript	JavaScript Source Code.
js	JavaScript Source Code.
jse	JScript Encoded Script File.
json	JavaScript Object Notation file.
ksh	UNIX Shell Script.
lib	Windows static-link library.
lnk	Windows Shortcut File.
mad	Access Module Shortcut (Microsoft).
maf	Access (Microsoft).
mag	Access Diagram Shortcut (Microsoft).
mam	Access Macro Shortcut (Microsoft).
maq	Access Query Shortcut (Microsoft).
mar	Access Report Shortcut (Microsoft).
mas	Access Stored Procedures (Microsoft).
mat	Access Table Shortcut (Microsoft).
mau	Media Attachment Unit.
mav	Access View Shortcut (Microsoft).
maw	Access Data Access Page (Microsoft).
mcf	Multimedia Container Format.
mda	Access Add-in (Microsoft), MDA Access 2 Workgroup (Microsoft).
mdb	Access Application (Microsoft), MDB Access Database (Microsoft).
mde	Access MDE Database File (Microsoft).
mdt	Access Add-in Data (Microsoft).
mdw	Access Workgroup Information (Microsoft).
mdz	Access Wizard Template (Microsoft).
msc	Microsoft Management Console Snap-in Control File (Microsoft).
msh	Microsoft Shell.
msh1	Microsoft Shell.
msh1xml	Microsoft Shell.
msh2	Microsoft Shell.
msh2xml	Microsoft Shell.
mshxml	Microsoft Shell.
msi	Windows Installer File (Microsoft).
ms-one-stub	Microsoft OneNote stub.
msp	Windows Installer Update.
mst	Windows SDK Setup Transform Script.
ocx	Object Linking and Embedding (OLE) Control Extension.
ops	Office Profile Settings File.
pcd	Visual Test (Microsoft).
pif	Windows Program Information File (Microsoft).
pl	Perl script.
plg	Developer Studio Build Log.
prf	Windows System File.
prg	Program File.
printer	Printer file.
ps	Windows PowerShell.
ps1	Windows PowerShell.
ps1xml	Windows PowerShell.
ps2	Windows PowerShell.
ps2xml	Windows PowerShell.
psc1	Windows PowerShell.
psc2	Windows PowerShell.
pst	MS Exchange Address Book File, Outlook Personal Folder File (Microsoft).
reg	Registration entries.
scf	Windows Explorer command file.
scr	Windows Screen Saver.
sct	Windows Script Component, Foxpro Screen (Microsoft).
shb	Windows Shortcut into a Document.
shs	Shell Scrap Object File.
shtm	HTML file that contains server-side directives.
shtml	HTML file that contains server-side directives.
soap	Simple Object Access Protocol file.
stm	HTML file that contains server-side directives.
svc	Windows Communication Foundation (WCF) service file.
sys	Real mode device driver.
tmp	Temporary File or Folder.
url	Internet Location.
vb	VBScript File or Any Visual Basic Source.
vbe	VBScript Encoded Script File.
vbs	VBScript Script File, Visual Basic for Applications Script.
vbscript	VBScript Script File, Visual Basic for Applications Script.
vxd	Virtual document exchange.
vscript	VBScript Script File, Visual Basic for Applications Script.
vsix	Visual Studio Extension.
vsmacros	Visual Studio .NET Binary-based Macro Project (Microsoft).
vsw	Visio Workspace File (Microsoft).
ws	Windows Script File.
wsc	Windows Script Component.
wsf	Windows Script File.
wsh	Windows Script Host Settings File.
xamlx	Visual Studio Workflow service file.
xnk	Exchange Public Folder Shortcut.

Attachments and Antivirus Software

When you use the attachment controls to upload or download a file between the product and a LOB (line of business) system, the file may contain a virus depending on the source of the file. The antivirus software installed, must support and have real-time protection enabled, and must not exclude the w3wp.exe process from real-time protection, because when uploading a file through the file attachment control, the file is streamed through the IIS w3wp.exe process. Files uploaded or downloaded using the attachment controls are temporarily stored in isolated storage which is monitored for viruses.

You can find the control in the Attachment section of the Toolbox.

The control interacts with other controls through rules. When you bind properties between different controls, you can use the data to populate properties or set values. Use the following examples for when to use the control with other controls through rules:

• Set a control’s properties: You can configure the settable properties such as file types and sizes of the control with this action
• Show/Hide: The Visible property allows you to show or hide the control through rules
• Enable/Disable: The Enabled property allows you to enable or disable the control through rules

• When you have a form with many views and multiple states the form rules might not show after you add an additional state. This happens when the form definition increases and exceeds the MaxRequestLength setting in the web.config. Edit this setting if you want to be able to have larger form definitions. The default maximum value is set as 16384 KB. See the following link for more details about the MaxRequestLength setting: HttpRuntimeSection.MaxRequestLength Property (Microsoft)
  The MaxRequestLength setting is configured on the Tenant infrastructure. If you need to change these settings, contact Nintex Customer Central to log a support ticket.

• Request filtering is a feature that can be configured in Internet Information Services (IIS)

  Copy

  requestLimits

  1
  2
  3
  4
  5
  6
  7
  8
  <system.webServer>
                                  <security>
                                  <requestFiltering>
                                  <requestLimits maxAllowedContentLength="1073741824"></requestLimits>
                                  </requestFiltering>
                                  </security>
                                  </system.webServer>
                              

  See the following link for more detail: Request Limits <requestLimits> (Microsoft)

  If you enable this setting on an environment, it is important to note that the minimum value of the MaxRequestLength setting, the requestFiltering setting and the MaxSize setting limits the attachments to upload.

• You can blacklist files with no extension by adding two commas in the blacklist with or without spaces, for example:
  
  
  
• The Enter key does not open a file browse dialog in Internet Explorer
• When you configure a form for anonymous access, you cannot upload or download files with the File Attachment, Image Attachment and Picture controls. You should carefully consider and evaluate the impact of allowing file uploads and downloads with anonymous access forms, since doing so may be considered a security vulnerability. User credentials and authentication are not required for anonymous access forms and therefore any files uploaded or downloaded with such forms can be performed by anyone that can access the form, without having to provide credentials.
  To allow file uploads and downloads for anonymous access forms, log a support ticket with Nintex Customer Central portal to adjust the Forms.Controls.File.AllowAnonymousAccess and Forms.Controls.Image.AllowAnonymousAccess settings to true for your environment.
  You must set the values to true to allow the controls to function when you access them through anonymous access forms. If you do not add this setting or if you set it to false, the controls do not work on anonymous access forms, namely errors occur when uploading or downloading files, and image thumbnails may not display. This configuration applies to the entire site and all anonymous access forms. It is not possible to configure security for the File Attachment, Image, and Picker controls for individual anonymous forms.
• When you configure a form for anonymous access, you cannot upload or download files with the File Attachment control. You should carefully consider the impact of allowing file uploads and downloads with anonymous access forms, since doing so may be considered a security vulnerability. User credentials and authentication are not required for anonymous forms and therefore any files uploaded or downloaded with these forms can be performed by anyone that can access the form, without having to provide credentials . To allow file uploads and downloads on anonymous access forms, you must request a change to a configuration setting on the Tenant infrastructure from the Nintex Customer Central team. Note that this configuration applies to the site as a whole and all anonymous access forms, and it is not possible to configure security for the File Attachment control for individual forms.
• The File Attachment control does not allow uploading of certain types of files, including but not limited to:
  • .cpl
  • .vxd
  • .cmd
  • .pif
  • .com
  • .msi
  • .scr
  • .ps
  • .wsh
  • .ocx
  • .dll
  • .bat
  • .exe
  • .vbs
  • .vbe
  • .vb
  • .aspx
  • .vbscript
  • .vscript
  • .javascript
  • .jscript
  • .js
• You can use the control with forms saved as a draft in the Workspace (Mobile) app to save the data on the form to resume at a later point or to work on the form while offline. See How To: Configure Forms with Draft Functionality, Drafts in Android and Building SmartForms for Mobile Devices for more information on saving a form as a draft in the Workspace (Mobile) apps.
• If you save a form as a draft form in the Workspace (Mobile) apps and you want to attach an item to the form, make sure you have enough memory on your mobile device. The attachment is saved to your device's memory while the form is in the Drafts folder.
• You can only attach one file to a file attachment control at a time
• To attach multiple files to a file attachment control, add your files to zip file and attach the zip file to the control
• When you use the control on a mobile device, you can add and annotate images and files. See Mobile App Feature Availability for information on features per platform (OS) for the Mobile and Workspace (Mobile) apps.