---
schema_version: "1"
id: 077943ab646ea5af21a413b3376c7778acb0708b587f6300be27f155d43d95c1
title: FileUploadAndDownloadSecuritySettings
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_fileuploadanddownloadsecuritysettings.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_fileuploadanddownloadsecuritysettings.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 8874a7655a103e9c6c7431613527ac8a2ade72bc3371679bd2d18420f4703301
description: Represents the security settings for uploading and downloading files. This type extends the Metadata metadata type and inherits its fullName field.
---
# FileUploadAndDownloadSecuritySettings

Represents the security settings for uploading and downloading files. This type extends the Metadata metadata type and inherits its fullName field.

## File Suffix and Directory Location

FileUploadAndDownloadSecuritySettings components have the suffix .settings and are stored in the settings folder.

## Version

FileUploadAndDownloadSecuritySettings components are available in API version 39.0 and later.

## Fields

| Field Name | Field Type | Description |
| --- | --- | --- |
| dispositions | [FileTypeDispositionAssignmentBean\[\]](#FileTypeDispositionAssignmentBean) | Represents the metadata used to manage filetype behavior. This field is available in API version 39.0 and later. |
| noHtmlUploadAsAttachment | boolean | Indicates whether to allow HTML uploads as attachments or document records. This field is available in API version 39.0 and later. |

## FileTypeDispositionAssignmentBean

Represents the metadata used to manage filetype behavior.

<table class="featureTable sort_table" summary="">



          <thead class="thead sorted" align="left">
            <tr>
              <th class="featureTableHeader  " id="d508598e153">Field Name</th>

              <th class="featureTableHeader  " id="d508598e156">Field Type</th>

              <th class="featureTableHeader  " id="d508598e159">Description</th>

            </tr>

          </thead>

          <tbody class="tbody">
            <tr>
              <td class="entry" headers="d508598e153" data-title="Field Name"><span class="keyword parmname">behavior</span></td>

              <td class="entry" headers="d508598e156" data-title="Field Type">FileDownloadBehavior (<a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_objects_intro.htm#enumeration_title">enumeration</a> of type string)</td>

              <td class="entry" headers="d508598e159" data-title="Description">One of the following values:<ul class="ul bulletList">
                  <li class="li">DOWNLOAD</li>

                  <li class="li">EXECUTE</li>

                  <li class="li">HYBRID</li>

                </ul>
                The following filetypes are a security risk and can not have
                EXECUTE behavior:<ul class="ul bulletList">
                  <li class="li">EXE</li>

                  <li class="li">FLASH</li>

                  <li class="li">HTML</li>

                  <li class="li"> RFC822</li>

                  <li class="li">SVG</li>

                  <li class="li">TXML</li>

                  <li class="li">UNKNOWN</li>

                  <li class="li">WEBVIEW</li>

                  <li class="li">XHTML</li>

                  <li class="li">XML</li>

                </ul>
              </td>

            </tr>

            <tr>
              <td class="entry" headers="d508598e153" data-title="Field Name"><span class="keyword parmname">filetype</span></td>

              <td class="entry" headers="d508598e156" data-title="Field Type">FileType (<a class="xref" href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_objects_intro.htm#enumeration_title">enumeration</a> of type string)</td>

              <td class="entry" headers="d508598e159" data-title="Description">Although more filetypes exist, these are the only ones supported
                by FileTypeDispositionAssignmentBean <ul class="ul bulletList">
                  <li class="li">AVI</li>

                  <li class="li">EXCEL</li>

                  <li class="li">EXCEL_X</li>

                  <li class="li">EXE</li>

                  <li class="li">FLASH</li>

                  <li class="li">HTML</li>

                  <li class="li">INSIGHT</li>

                  <li class="li">MOV</li>

                  <li class="li">MP3</li>

                  <li class="li">MP4</li>

                  <li class="li">MPEG</li>

                  <li class="li">PDF</li>

                  <li class="li">POWER_POINT</li>

                  <li class="li">POWER_POINT_X</li>

                  <li class="li">RFC822</li>

                  <li class="li">SVG</li>

                  <li class="li">TXML</li>

                  <li class="li">UNKNOWN</li>

                  <li class="li">WAV</li>

                  <li class="li">WEBVIEW</li>

                  <li class="li">WMA</li>

                  <li class="li">WMV</li>

                  <li class="li">WORD</li>

                  <li class="li">WORD_X</li>

                  <li class="li">XHTML</li>

                  <li class="li">XML</li>

                </ul>
              </td>

            </tr>

            <tr>
              <td class="entry" headers="d508598e153" data-title="Field Name"><span class="keyword parmname">securityRiskFileType</span></td>

              <td class="entry" headers="d508598e156" data-title="Field Type">boolean</td>

              <td class="entry" headers="d508598e159" data-title="Description">Indicates filetypes that cannot have behavior set to EXECUTE, due
                to security risks. This field is read-only.</td>

            </tr>

          </tbody>

        </table>

## Declarative Metadata Sample Definition

The following is an example of a FileUploadAndDownloadSecuritySettings component.

<FileUploadAndDownloadSecuritySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>AVI</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>WORD</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>WORD\_X</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>EXE</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>HTML</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>WEBVIEW</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>RFC822</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>MOV</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>MP3</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>MP4</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>MPEG</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>PDF</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>POWER\_POINT</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>POWER\_POINT\_X</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>SVG</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>FLASH</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>TXML</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>UNKNOWN</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>WAV</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>WMA</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>WMV</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>XHTML</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>EXCEL</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>HYBRID</behavior\>
        <fileType\>EXCEL\_X</fileType\>
        <securityRiskFileType\>false</securityRiskFileType\>
    </dispositions\>
    <dispositions\>
        <behavior\>DOWNLOAD</behavior\>
        <fileType\>XML</fileType\>
        <securityRiskFileType\>true</securityRiskFileType\>
    </dispositions\>
    <noHtmlUploadAsAttachment\>false</noHtmlUploadAsAttachment\>
</FileUploadAndDownloadSecuritySettings\>

The following is an example package.xml that references the previous definition.

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
   <types\>
       <members\>FileUploadAndDownloadSecurity</members\>
       <name\>Settings</name\>
   </types\>
   <version\>39.0</version\>
</Package\>

## Wildcard Support in the Manifest File

The wildcard character \* (asterisk) in the package.xml manifest file doesn’t apply to metadata types for feature settings. The wildcard applies only when retrieving all settings, not for an individual setting. For details, see [Settings](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_settings.htm). For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/file_based_zip_file.htm).