# How to ban TL1 or other groups to attach attachments in topics?
**URL:** https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205
**Category:** Support
**Created:** [January 8, 2025, 3:45pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205 "2025-01-08T15:45:47Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 3:45pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/1 "2025-01-08T15:45:47Z")
I’m actually concerned that someone might maliciously upload files and fill up my S3 bucket. It would be great if there was a setting to limit the number of uploads or the total file size per user per day.
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [January 8, 2025, 4:49pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/2 "2025-01-08T16:49:22Z")
To directly answer your topic’s title,
> [@Restrict uploads](https://meta.discourse.org/t/restrict-uploads/112688):
>
> This is a very small theme component that will remove the upload button from the composer toolbar and disable drag-and-drop uploading for users that are under a specified trust level. Illustration Settings hammer_and_wrenchRepository [github.com/tshenry/discourse-restrict-uploads](https://github.com/tshenry/discourse-restrict-uploads)open_bookNew to Discourse Themes? [Beginner’s guide to using Discourse Themes](https://meta.discourse.org/t/beginners-guide-to-using-discourse-themes/91966) Install this theme component
Since it’s a theme component, it can be bypassed by users, especially if they can enable the [safe mode](https://meta.discourse.org/t/53504?silent=true). That’s a “soft” limitation, sort to speak.
It also doesn’t support groups, but that could be asked as a #Contribute > Feature request 🙂
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 5:25pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/3 "2025-01-08T17:25:53Z")
| | |
| --- | --- |
| Max image size KB | The maximum image upload size. This must be configured in nginx (client\_max\_body\_size) / apache or proxy as well. Images larger than this and smaller than client\_max\_body\_size will be resized to fit on upload. |
| Max attachment size KB | The maximum attachment files upload size. This must be configured in nginx (client\_max\_body\_size) / apache or proxy as well. |
```plaintext
params:
## Which Git revision should this container use? (default: tests-passed)
version: tests-passed
## Maximum upload size (default: 10m)
upload_size: 20m
```
I want to know if I can limit the number of upload attempts or the total file size per user per day through that method?
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 5:30pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/4 "2025-01-08T17:30:38Z")
I want to block malicious users, you know, but the component you recommended can only block regular users. 💔
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [January 8, 2025, 5:42pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/5 "2025-01-08T17:42:03Z")
It’s not possible to set such a limitation without creating a custom plugin.
> [@copymonopoly](#):
>
> I’m actually concerned that someone might maliciously upload files and fill up my S3 bucket.
Do you suspect it already happened? Did you notice a sudden increase in uploads used space?
If not, what makes you think such an exploit could happen?
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [January 8, 2025, 5:46pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/6 "2025-01-08T17:46:27Z")
Maybe it helps to describe your problem more specifically. Which file extensions are allowed on your forum (`Authorized extensions` site setting)? By default, only images are allowed. Then requiring approval for posts containing images from users with a low trust level could help (`Skip review media groups`).
You can also identify such users in the “Top uploads” report in the admin area.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 5:49pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/7 "2025-01-08T17:49:24Z")
There isn’t any at the moment, maybe I’m being too pessimistic. However, as you mentioned, even if it’s a plugin, it can be disabled through [safe mode](https://meta.discourse.org/t/53504?silent=true). It seems that the only way to prevent it is through server or S3 bucket settings.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 5:59pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/8 "2025-01-08T17:59:40Z")
Thank you for your advice. However, if it’s a malicious user, can they disguise other files as image formats? And since there are no restrictions on the number or total size of images, can they still upload images without limit? Also, I still don’t understand whether the files will occupy my S3 bucket if they upload successfully but don’t publish a topic.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [January 8, 2025, 6:00pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/9 "2025-01-08T18:00:08Z")
> [@copymonopoly](#):
>
> However, as you mentioned, even if it’s a plugin, it can be disabled through [safe mode](https://meta.discourse.org/t/53504?silent=true).
Only the front-end functionality of plugins is disabled in [safe mode](https://meta.discourse.org/t/53504?silent=true). The backend limitations remain.
You can also disable [safe mode](https://meta.discourse.org/t/53504?silent=true) for users.
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [January 8, 2025, 6:02pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/10 "2025-01-08T18:02:19Z")
> [@copymonopoly](#):
>
> There isn’t any at the moment, maybe I’m being too pessimistic.
You can imagine thousands of ways of disrupting any software in which you can add data, so I wouldn’t worry about this imaginary problem and focus my attention on other things 😛
---
### Author:  [@bryce](https://meta.discourse.org/u/bryce)
#### Post date: [January 8, 2025, 6:05pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/11 "2025-01-08T18:05:16Z")
> [@copymonopoly](#):
>
> Also, I still don’t understand whether the files will occupy my S3 bucket if they upload successfully but don’t publish a topic.
[Here’s](https://meta.discourse.org/t/cleaning-up-uploads-and-purging-uploads-from-s3/248343) some documentation regarding that.
> [@Cleaning up uploads and purging uploads from S3](https://meta.discourse.org/t/cleaning-up-uploads-and-purging-uploads-from-s3/248343/1):
>
> ## Purging S3 uploads
>
> Cleaning up orphan and deleted uploads works similarly for both local and S3 storages. The only difference between the local storage and S3 storages is that the cleanup of the S3 uploads is automatically handled by S3 via a [tombstone policy](https://github.com/discourse/discourse/blob/3141c179f727772bf32798b48f5355918c3924b4/lib/s3_helper.rb#L49-L66). See [Managing your storage lifecycle](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) for additional details about how this is handled on S3.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [January 8, 2025, 6:08pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/12 "2025-01-08T18:08:34Z")
You can also try removing `trust_level_0` from the `Embedded media post allowed groups` site setting and adding it to another trust level group. Though I was still able to upload my image, I wasn’t able to post it with my test user.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 6:15pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/13 "2025-01-08T18:15:23Z")
Maybe you’re right. I shouldn’t let too many concerns stop me from taking action.I am a perfectionist, and too many worries always make me easily discouraged.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 6:21pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/14 "2025-01-08T18:21:08Z")
I think I’ll use this feature, even though I don’t really want to create too many obstacles for normal users. I just don’t want to be played with or taken advantage of by a very small number of evil users.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 8, 2025, 6:25pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/15 "2025-01-08T18:25:15Z")
If I understand correctly, it works as I thought: the upload will occupy space in the S3 bucket, which really worries me. While there is an automatic cleanup feature that works well under normal circumstances, malicious users can easily bypass posting restrictions and keep uploading files.
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [January 8, 2025, 10:19pm UTC](https://meta.discourse.org/t/how-to-ban-tl1-or-other-groups-to-attach-attachments-in-topics/346205/16 "2025-01-08T22:19:40Z")
Regarding safe-mode.
> [@Using AI to create Hide content bbcode wrapper](https://meta.discourse.org/t/using-ai-to-create-hide-content-bbcode-wrapper/321078/8):
>
> > [@Using AI to create Hide content bbcode wrapper](https://meta.discourse.org/t/using-ai-to-create-hide-content-bbcode-wrapper/321078/7):
> >
> > Can [safe mode](https://meta.discourse.org/t/53504?silent=true) be restricted to Staff/Admin?
>
> yes. disabling this will make it so only staff can use safe-mode.
>
> 