Update

devplacepy/routers/uploads.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse
 from devplacepy.database import get_table, get_setting
 from devplacepy.utils import require_user
-from devplacepy.attachments import store_attachment, delete_attachment as _delete_attachment
+from devplacepy.attachments import store_attachment, delete_attachment as _delete_attachment, ALLOWED_UPLOAD_TYPES
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -19,14 +19,16 @@ async def upload_file(request: Request):
     if not file or not hasattr(file, "filename") or not file.filename:
         return JSONResponse({"error": "No file provided"}, status_code=400)
 
+    ext = Path(file.filename).suffix.lower()
+    if ext not in ALLOWED_UPLOAD_TYPES:
+        return JSONResponse({"error": f"File type '{ext}' not allowed"}, status_code=415)
+
     allowed_types_raw = get_setting("allowed_file_types", "").strip()
     allowed_extensions = set()
     if allowed_types_raw:
-        for ext in allowed_types_raw.split(","):
-            ext = ext.strip().lower()
-            allowed_extensions.add(ext if ext.startswith(".") else f".{ext}")
-
-    ext = Path(file.filename).suffix.lower()
+        for allowed_ext in allowed_types_raw.split(","):
+            allowed_ext = allowed_ext.strip().lower()
+            allowed_extensions.add(allowed_ext if allowed_ext.startswith(".") else f".{allowed_ext}")
     if allowed_extensions and ext not in allowed_extensions:
         return JSONResponse({"error": f"File type '{ext}' not allowed"}, status_code=415)