[henryjonathanquispe]

Issue & Reproduction Steps

Customizable file extension whitelist

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-34054

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cursor]

PR Summary

Medium Risk
Changes file-upload security allowlists; incorrect env values could widen uploads or block valid files, though defaults are unchanged when env is not set.

Overview
Upload extension policy can now be tuned per deployment without editing config/files.php. Comma-separated ALLOWED_EXTENSIONS and DANGEROUS_EXTENSIONS in .env override the built-in lists; when unset or empty, the same default allow/deny sets as before are used.

Parsing normalizes entries (trim, lowercase, drop empties). .env.example documents the new variables, and FilesConfigTest covers defaults, env overrides, and dangerous-extension defaults.

^{Reviewed by Cursor Bugbot for commit eff0187. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit eff0187. Configure here.}