More flexible upload options for admin?

[hawm]

Support disable user upload at post or topic but available for user avatar and profile backgrounds etc.
Set the max size to 0 and hide the upload button or options on post by CSS not really a good way, it break all upload even admin like category background image.

Remove image uploading in posts

Is there a way to remove the upload option for images? We didn’t want to “host” images on our forums. We’d rather the end users just put the image link in. If this isn’t an option, is there a way to hide the image upload button? (CSS?)

[tshenry (Taylor)]

See if this will meet your needs:

Restrict uploads

This is a very small theme component that will remove the upload button from the composer toolbar and disable drag-and-drop uploading for users that are under a specified trust level. Illustration [unrestricted] [restricted] Settings [setting] Repository github.com/tshenry/discourse-restrict-uploads New to Discourse Themes? Beginner’s guide to using Discourse Themes Install this theme component

[hawm]

@tshenry
A good component. But it seem too basic? The code looks only restrict the browser UI.

[tshenry (Taylor)]

I’m not sure what you mean by too basic. It prevents the upload button from rendering on the composer toolbar and disables the drag-and-drop upload functionality of the composer. This will only apply to users under a trust-level you specify in the theme setting. It’s not just hiding a button with CSS if that’s what you are concerned about.

Theme components are super easy to add and remove, so there’s no harm in testing it out and seeing if it meets you needs.

[hawm]

Yes, i already install the component and actually it is working not bad.
What i mean about “too basic” is the component still restrict the web editor only.

The code below i guess it will only disable the upload or reply placeholder on the web editor(if i was wrong that i have no question with the component, ignore below).
https://github.com/tshenry/discourse-restrict-uploads/blob/master/common/head_tag.html

I know the upload using Upload API, so somebody which familiar with network programming may construct some HTTP requests(i dont know if some security like CORS can protect it) to bypass the component then upload file(even though the uploaded is harmless, but any upload by user are not our expected).

So, restrict the Upload API type field in the back-end may improve it? I am newbie to Discourse and programming.
Thanks.

[tshenry (Taylor)]

@hawm

I know the upload using Upload API, so somebody which familiar with network programming may construct some HTTP requests(i dont know if some security like CORS can protect it) to bypass the component then upload file(even though the uploaded is harmless, but any upload by user are not our expected).

Hopefully I will be corrected if I am wrong, but I believe they would need to have a valid API key do that. An API key would need to be explicitly generated for a user by an admin.

You are correct, though. This is not a server-side solution. If you need an extremely secure solution, you would need to build a plugin or hope that the feature is added to core.

[hawm]

I am clear now, thanks！