In msg5188	of issue2550848 a better solution is outlined.
This is the issue to track it.

How does the following sound.

We keep the default whitelist and replace allow_html_file with
two options:
  
  # Roundup has a whitelist of mime types that it will serve. If a
  # file's mime type is in the whitelist, it will be served using the
  # mime type. If the file type is not in the whitelist, the file will
  # be served with type application/octet-stream.
  # If you want to override the whitelist, set this to no and set the
  # mime types in serve_mime_types.
  use_default_whitelist = yes

  # A comma separated list of mime types that will be served by roundup.
  # If use_default_whitelist is yes, these will be added to the default
  # whitelist. Otherwise they will be the only types that are not
  # served as application/octet-stream.
  serve_mime_types = 


Thoughts?

Bern,

Any thoughts on my suggestion of adding use_default_whitelist and
serve_mime_types?

I wonder if setting serve_mime_types should just override the default list making
use_default_whitelist unneeded?

Should serve_mime_types be renamed somehow? allowed_serve_mine_types maybe?

In release 2.4.0, the allowed list is exposed at the class level and can be manipulated
via interfaces.py.

See doc at:

  https://www.roundup-tracker.org/docs/admin_guide.html#controlling-browser-handling-of-
attached-files

I don't expect this will be customized often, so leave this as an interfaces tweak
rather than config file. It keeps the allow_html_file config.ini setting.