How do I disable attachments for an ActionText field? The only solutions I can find are to hide the Trix button with CSS and a validator for the host model (which makes the model invalid, but it does not prevent a file from being uploaded). Surely I’m missing something?
By only removing the button with CSS and preventing the host model from being valid, I’m still allowing a user to upload as many files of any size to the server as they please.
Additionally, it seems that ActionText/ActiveStorage does not clean up the orphaned files if a user removes one: 1) user adds an attachment 2) user sees the validation that attachments are not allowed 3) user removes attachment 4) attachment seems to persist on the server.
Interesting, I think blocking trix-file-accept is probably the missing client-side piece here. That should stop drag/drop or pasted files before Trix turns them into attachments.
I still wouldn’t treat that as the security boundary, though. If uploads genuinely aren’t allowed for these users, I’d enforce the same rule around the Active Storage direct-upload endpoint as well. Purging unattached blobs is worth having as cleanup, but it only deals with the file after the upload already happened.
Hiding the Trix button only changes the UI, so it won’t stop direct upload requests. I’d handle this at the server side by restricting the ActionText attachment endpoint or overriding the attachment handling so unauthorized uploads are rejected before ActiveStorage persists them. That also avoids relying on model validation for upload prevention.