# Restrict uploads
**URL:** https://meta.discourse.org/t/restrict-uploads/112688
**Category:** Theme component
**Created:** [March 27, 2019, 11:03am UTC](https://meta.discourse.org/t/restrict-uploads/112688 "2019-03-27T11:03:40Z")
**Posts on this page:** 10
**Page:** 2
### Author:  [@hipp0](https://meta.discourse.org/u/hipp0)
#### Post date: [January 24, 2026, 9:13pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/25 "2026-01-24T21:13:36Z")
Thanks it works
---
### Author:  [@hipp0](https://meta.discourse.org/u/hipp0)
#### Post date: [January 24, 2026, 9:14pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/26 "2026-01-24T21:14:55Z")
> [@tshenry](#):
>
> The fix has been merged 🚀 Thanks again, @Moin! If you end up working on the additional modernization, ping me when it’s ready and I’ll work on getting it merged.
Now can we get this component to restrict to subscriber groups 😛
Only way I can do it myself is making Trust Level 3 impossible to get to by increasing the number of days, etc. And then manually adding people when they subscribe. Which is most likely the route I will take unless I can modify this by group.
---
### Author:  [@hipp0](https://meta.discourse.org/u/hipp0)
#### Post date: [January 25, 2026, 5:17am UTC](https://meta.discourse.org/t/restrict-uploads/112688/27 "2026-01-25T05:17:03Z")
Restrict Uploads is now blocking the ability to upload at all on new post or replies.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [January 25, 2026, 11:41am UTC](https://meta.discourse.org/t/restrict-uploads/112688/28 "2026-01-25T11:41:02Z")
That’s right, sorry.
It looks like `this._super()` doesn’t actually report whether the user is allowed to upload images in core. I had reused it from the old component, and I already noticed yesterday that it caused issues with the placeholder logic as well.
I don’t have time to dig deeper into this right now.
One thing I noticed while testing today: using `"*"` in `api.addComposerUploadHandler(["*"]` breaks the regex used for matching upload handlers.
---
### Author:  [@Andrew\_Rowe](https://meta.discourse.org/u/Andrew_Rowe)
#### Post date: [January 25, 2026, 2:50pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/29 "2026-01-25T14:50:45Z")
I think this seems like it should be a part of core. Just my humble opinion but a way of controlling uploads by trust level, group or even individual users would be very useful.
---
### Author:  [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [January 25, 2026, 3:18pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/30 "2026-01-25T15:18:08Z")
I believe you need to use the subclass method to overwrite this computed descriptor correctly.
```js
import discourseComputed from "discourse-common/utils/decorators";
api.modifyClass("service:composer",
(SuperClass) => class extends SuperClass {
@discourseComputed
allowUpload() {
return super.allowUpload && canUpload;
}
}
);
```
EDIT:
Made a PR:
[https://github.com/tshenry/discourse-restrict-uploads/pull/4](https://github.com/tshenry/discourse-restrict-uploads/pull/4)
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [March 23, 2026, 8:02pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/31 "2026-03-23T20:02:43Z")
> [@hipp0](#):
>
> Now can we get this component to restrict to subscriber groups 😛
I created a pull request which switches the component from trust level-based to group-based restrictions:
[https://github.com/tshenry/discourse-restrict-uploads/pull/6](https://github.com/tshenry/discourse-restrict-uploads/pull/6)
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [July 20, 2026, 6:55am UTC](https://meta.discourse.org/t/restrict-uploads/112688/33 "2026-07-20T06:55:11Z")
@tshenry are you interested in changing the component to work group based?
The changes would probably need to be adjusted now to reflect the changes in core regarding group settings in themes. But if you don’t want the change anyway, I don’t need to spend time on an update.
---
### Author:  [@tshenry](https://meta.discourse.org/u/tshenry)
#### Post date: [August 7, 2026, 11:54pm UTC](https://meta.discourse.org/t/restrict-uploads/112688/34 "2026-08-07T23:54:52Z")
@Moin I just left a comment on your PR regarding what I assume you were referring to on the group setting changes. Feel free to push an update if you are still interested in working on this. I have your PR branch set up on my test site now, so I should be able to help move this through.
---
### Author:  [@tshenry](https://meta.discourse.org/u/tshenry)
#### Post date: [August 11, 2026, 1:51am UTC](https://meta.discourse.org/t/restrict-uploads/112688/35 "2026-08-11T01:51:23Z")
@Moin’s excellent update to this component has been merged 🎉 Thank you Moin!
>
>
> \### Migrate from trust level to group-based upload restrictions
> Replaces the re…strict\_to\_trust\_level enum setting with restricted\_to\_groups, a list setting that accepts group IDs. This gives admins more flexibility – instead of being limited to trust levels, any combination of groups can be allowed.
>
> \### Changes:
> \* New setting restricted\_to\_groups (default: 3|10, i.e. staff and trust\_level\_0)
> \* Migration maps existing trust level values to the corresponding automatic groups (TL0→10, TL1→11, TL2→12, TL3→13, TL4→14) and always adds group 3 (staff)
> \* Upload permission is now checked against group membership instead of trust level
> \* Staff is no longer an implicit exception, instead the staff group is added to the setting by default.
>
> Note: The error dialog no longer mentions a specific trust level since the restriction is now group-based and telling the user about the group IDs did not seem helpful to me.
>
> Also updates linting/CI config and dependencies from latest theme component skeleton.
>
> @Arkshine already took a look and provided feedback.
I will try to get the OP of this topic updated soon to reflect all of the improvements that have come in from @Arkshine and @Moin this year.
[Previous page](https://meta.discourse.org/t/restrict-uploads/112688.md?page=1)