Resource Rendering controls were added to the XNAT Admin UI in version 1.8.4. Older versions of XNAT can enable or disable all resource rendering (but cannot white-list MIME types as described below) via the Site-wide Configuration API, using Swagger.
XNAT allows users to upload resources (aka files) and attach these to various items within the XNAT data hierarchy (subject, experiment, scan). The XNAT application supports the upload through the web user interface or through the RESTful API.
There are no restrictions on the types of files that are uploaded (e.g., xml, html, jpeg, pdf) nor on the content of those files. The upload feature provides a simple model for a site to extend their XNAT instance to collect data beyond the types managed by core XNAT code (e.g., DICOM files). Arbitrary resources uploaded by XNAT users may create a security risk for other users who would render those resources in their web browser.
Restricting Resource Rendering
The XNAT administration panel provides two levels of control for the rendering of resources that are stored as files in the XNAT system, located in Administer > Site Administration > Security.
Firstly, the Resource Rendering flag enables the administrator to enable or disable rendering across the entire instance. If disabled, when a user clicks on a resource in the Web UI, the resource will be downloaded and not rendered. The user has access to the downloaded file, but it is up to that user how they choose to use that file. If Resource Rendering is enabled, the resource can be rendered directly in the user's web browser.
The second level of control takes place when Resource Rendering is enabled. The administrator can enter a comma separated list of mime types in Resource Rendering Whitelist that XNAT will render when a user clicks on the relevant resource. This white list is consulted when resources are rendered. As mentioned above, the white list does not restrict what kinds of resource files can be uploaded.
XNAT only has support for allowing rendering of certain mime types. For more fine grained control, you can enter values from the list below; values are case in-sensitive. As a shortcut, you can enable all of the supported mime types by entering a * character in the list (no quotes).
Please note that XNAT snapshot and thumbnail images that are available at the scan level are stored as gif files. These will render properly within the scan preview regardless of the values of the settings above. However, if you wish users to be able to click on the snapshots in Manage Files and preview them in their browsers, you would need to enable that mime type.
Supported MIME-Types for Resource Rendering in XNAT
(Security Risk: Low)
(Security Risk: Medium)
|Document / Rich Text Formats|
(Security Risk: High)
There are several MIME-types that can commonly be rendered in browsers that are not included in this list. Any resource files of this type will be downloaded, even if the file extension is added to the whitelist.