Attachments are files stored with a page. In the React editor an author adds one by pasting or dropping it into the text, or from the Attachments panel, and the editor inserts the Markdown reference automatically.
![Uploading name…] (with empty () link target) is inserted at once and replaced by the real markup when the upload finishes (or removed, with an error toast, if it fails). On a new page that has not been saved yet, the placeholders go in immediately and the uploads start after the first save. A pasted clipboard image is named pasted-YYYYMMDD-HHMMSS.<ext>./attach/{Page}/{file}, the server does not generate thumbnails); rename; and delete, which asks for confirmation and shows how many times the editor text still references the file. The panel also holds an Ingest as derived page form (POST /api/ingest) that turns an uploaded document into a page; that is a separate feature from attachments. (written without #) for an image or [name](#file.pdf) (written without #) for anything else. A pasted or dropped upload inserts the same markup. The reference is the bare file name, which resolves to the page's own attachment.-, other disallowed characters are dropped, the name is shortened) and adds -2, -3 and so on when it collides with an existing attachment. The server enforces the same rules and refuses anything else.AttachmentNameValidator (server) and attachmentNameValidator.js (editor) accept a name only if it uses just a-z, A-Z, 0-9, _ and - plus exactly one period, starts with a letter or digit, is at most 40 characters, and has no - or _ directly before the period. When an upload sends a name, its extension must match the uploaded file's.
view; uploading needs upload; renaming needs edit; deleting needs delete. modify implies upload, so signed-in users can upload by default and anonymous visitors cannot, while only administrators can delete (see Database-Backed Permissions).wikantik.attachment.maxsize (bytes), wikantik.attachment.allowed and wikantik.attachment.forbidden (space-separated suffixes such as .png .jpg). All three ship blank, which means no size limit and every file type accepted, so set them wherever uploads are not limited to trusted users. A rejected upload gets HTTP 413 (too large) or 415 (type not allowed). Administrators are exempt. The same policy applies to the REST endpoint and to the legacy /attach/* upload servlet..html, .htm, .js, .pdf, .svg and .xml attachments force a download instead of opening inline (wikantik.attachment.forceDownload).BasicAttachmentProvider, a flat versioning store under wikantik.basicAttachmentProvider.storageDir (blank means a wikantik-files directory in the home folder of the user running Tomcat). Leaving wikantik.attachment.provider blank disables attachments.The REST servlet AttachmentResource (wikantik-rest) is mapped to /api/attachments/*; the React components are AttachmentPanel.jsx and PageEditor.jsx; storage goes through AttachmentManager in wikantik-main and the provider abstraction. Inline images and downloads are served by AttachmentServlet at /attach/{Page}/{file}.
| Request | Purpose |
|---|---|
GET /api/attachments/{Page} | list attachments (name, size, version, last modified) |
GET /api/attachments/{Page}/{file} | download one |
POST /api/attachments/{Page} | multipart upload: part file, optional name |
PUT /api/attachments/{Page}/{old} | rename, JSON body {"newName": "..."} |
DELETE /api/attachments/{Page}/{file} | delete |
Cluster Hub: Wikantik Platform Development Hub: Architecture, MCP Protocols, and Agent Briefings (wikantik-development)