# Release Notes — Upload Validation and Appointment Letters

**Date:** 24 July 2026

## Upload validation

General user document and supporting-evidence uploads now accept only:

- PDF
- JPG / JPEG
- PNG images
- DOC
- DOCX

Validation is enforced in both the browser file selector and on the server. The server checks the filename extension, detected MIME content, upload status and maximum file size before storing the file. Executable and mismatched files are rejected.

The updated policy applies to:

- HR staff documents
- Learning resources
- Assignment attachments
- Portfolio-of-evidence files
- Staff, student and profile photos
- Institution, letterhead, login, dashboard, exam-card and ID-card images

Dedicated structured-data imports remain available for authorised workflows that require CSV or XLSX, including student/course imports, sponsor allocation schedules, finance imports and procurement requisition imports. These are treated as data imports rather than document attachments.

## Appointment letters

- Removed the appointment-details table from the printed letter.
- Appointment letters now print the subject `APPOINTMENT TO THE ROLE OF [DESIGNATION]`.
- Added an editable `Roles and Responsibilities` field to the HR letter form.
- When responsibilities are left blank, the system generates role-specific duties for lecturers/trainers, finance, procurement/stores, HR, registry/admissions, ICT, library and other staff roles.
- Printed responsibilities appear as a clear numbered list.
- Existing appointment letters receive a generic responsibilities list during migration and are given the new subject format.

## Database update

Run:

```bat
C:\xampp\php\php.exe bin\migrate.php
C:\xampp\php\php.exe bin\check_integrity.php
```

Migration added: `database/migrations/20260724_010_upload_validation_and_appointment_roles.sql`.

## Validation performed

- All 203 PHP files passed `php -l` syntax validation.
- Appointment-letter SQL placeholder counts were checked against the supplied parameter arrays.
- The appointment-letter branch was checked to confirm that it does not render the appointment-details table.
- General attachment forms were checked for the updated allowed-file list.
