I have a requirement to inject javascript via a script editor web part into a form and validate that it's not a macro enabled Excel file (xltm or xlsm), and throw a validation error if it is and not allow the user to upload it. Is this possible? If so, anyone have some sample code to get me started? Thanks!

  • Modern UI or Classic UI? (Guessing Classic as you referred to "Script Editor Web Part".) – Mike Smith - MCT - MVP Aug 5 at 15:26
  • Classic UI...thanks! – Nate Aug 5 at 15:43

Sample JavaScript that could work for you... (i.e. code written over lunch break from memory and not fully tested :-) )

This returns null if there are no items, otherwise a collection of matched extensions. (not the full file names)


The regular expression ("match"):

  • The dot means something special in regular expressions, so it is escaped (\.) to just be a dot.
  • The pipe (|) means OR. So you could add more file types: \.xltm|\.xlsm|\.docm

You could write this in a IF:

if( !document.getElementById("idAttachmentsTable").innerText.match("\.xltm|\.xlsm") )
{ stuff to do if there are matches... cancel the save }
{ stuff to do if there are no matching files... allow the save }

For SharePoint forms: (we just need to return True if ok to save)

function PreSaveAction() {
   return !document.getElementById("idAttachmentsTable").innerText.match("\.xltm|\.xlsm");

You might want want to include an error message. The text next to the attached files list has a handy ID ("Attachments") that can be used to change the default text.

function PreSaveAction() {
  if ( document.getElementById("idAttachmentsTable").innerText.match("\.xltm|\.xlsm") )
  {  document.getElementById("Attachments").innerHTML = 'Attachments <br><span style="color:red">cannot include macros (.xlsm, .xltm)</span>';
     return false;
  { document.getElementById("Attachments").innerHTML = 'Attachments';
    return true;
  • Just tested it and it seems to work great! Thanks so much for the assist! – Nate Aug 5 at 18:53

I doubt that you can easily prevent the upload of these files as the upload is triggered from a button click and completed within the upload code/dialog. You can check after the upload and then prevent the saving of the item.

If you are using the Classic UI New Item form... Attachments are listed at the bottom of the form in an HTML table with the ID "idAttachmentsTable". Write JavaScript to iterate through that table when the user clicks the Save button. Or, you could use JavaScript to search all of the HTML for the sting "fakepath" and then check the file extensions. Search for "sharepoint function PreSaveAction" for more adding your custom validation on the Save button. (Or start here.)

enter image description here

  • I think i'm okay doing it in the PreSaveAction function as long as i prompt them and not let them save until they remove the file and click save again. So i think it's just a matter of getting the code to iterate through all file attachments and reject if any are those extensions. – Nate Aug 5 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.