Attachment Upload Guide

How to upload, manage, and download supporting documents across all ORIC modules.

1. Overview

Every module supports file attachments for evidence, supporting documents, and official records. Attachments are stored securely with:

• SHA-256 checksums for integrity verification
• Server-side MIME validation (not relying on browser-reported type)
• Safe filenames — random hex names, no user-controlled paths
• Access control — only the owner and ORIC staff can download
• Audit logging — every upload and delete is recorded

2. Supported File Types

Extension	MIME Type	Common Use
.pdf	application/pdf	Official documents, reports, certificates
.doc, .docx	application/msword, application/vnd.openxmlformats...	Proposal documents, letters, agreements
.xls, .xlsx	application/vnd.ms-excel, application/vnd.openxmlformats...	Budget sheets, financial data
.jpg, .jpeg	image/jpeg	Scanned documents, photos
.png	image/png	Screenshots, diagrams
.gif	image/gif	Simple graphics
.txt	text/plain	Plain text notes
.csv	text/csv	Data exports, spreadsheets

3. File Size Limits

Maximum file size: 10 MB per attachment. If you need to upload larger files, contact the system administrator.

4. How to Upload Attachments

4.1 From the View Page

When viewing any submission (publication, grant, IP disclosure, or revenue line), you will see an Attachments section:

1. If no attachments exist, click the "Upload Files" button
2. If attachments already exist, click the "Upload" button in the section header
3. You will be taken to the attachment upload page for that submission

4.2 On the Upload Page

1. Select attachment type from the dropdown (varies by module):
   • Grants: Supporting Document, Proposal Document, Budget Sheet, Approval Letter, Other
   • IP Disclosures: Supporting Document, Disclosure Document, Filing Certificate, Registration Certificate, Other
   • Revenue: Audited Statement, Approval Letter, Grant Agreement, Budget Sheet, Other
2. Choose a file using the file picker (or drag-and-drop if supported)
3. Click "Upload"
4. On success, you will see a confirmation message and the file will appear in the attachment list

4.3 Uploading Multiple Files

Upload files one at a time. After each upload, the page refreshes and you can upload another file. There is no limit on the number of attachments per submission.

5. Managing Attachments

5.1 Downloading

Click the Download button (download icon) next to any attachment. The file will download with its original filename.

5.2 Deleting

Click the Delete button (trash icon) next to any attachment. You will be asked to confirm before deletion.

6. Attachment Access Control

Role	Upload	Download	Delete
Submission Owner (Researcher)	Yes	Yes	Yes (own attachments only)
ORIC Staff	Yes	Yes (any)	No
Admin	Yes	Yes (any)	No
Other Users	No	No	No

7. Security Features

• MIME detection: Server uses finfo to detect actual file type, not the browser-reported type
• Extension validation: Both allowlist and blocklist checks are performed
• Safe storage: Files are stored with random hex filenames in date-organized directories (YYYY/MM/DD/{random}.ext)
• File permissions: 0640 on files, 0750 on directories
• Checksums: SHA-256 hash computed on upload for integrity verification
• Directory protection: index.html files prevent directory listing

8. Troubleshooting

8.1 "File size exceeds maximum allowed"

Your file is larger than 10 MB. Compress the file or split it into smaller parts.

8.2 "MIME type is not allowed"

The file's actual content type is not in the allowed list. Convert the file to PDF, Word, Excel, or an image format.

8.3 "File type is not allowed for security reasons"

The file extension is blocked (e.g., .exe, .php, .js). Rename or convert the file to an allowed format.

8.4 "File not found on disk"

The attachment record exists in the database but the file is missing from storage. Contact the system administrator.

8.5 "Access denied" on download

You do not have permission to download this attachment. Only the submission owner and ORIC staff can download attachments.