Upgrade allow adding image in ticket details page comment section

app/routes/admin.py

@@ -741,4 +741,38 @@ def activity_logs():
 
 
 def _roles():
-    return [UserRole.EMPLOYEE, UserRole.IT_STAFF, UserRole.ADMIN]
+    return [UserRole.EMPLOYEE, UserRole.IT_STAFF, UserRole.ADMIN]
+
+
+@admin_bp.route('/settings', methods=['GET', 'POST'])
+@admin_required
+def settings():
+    from app.models import SystemSetting
+
+    if request.method == 'POST':
+        new_value = '1' if request.form.get('registration_enabled') == '1' else '0'
+        old_value = SystemSetting.get('registration_enabled', 'true')
+        SystemSetting.set(
+            'registration_enabled',
+            new_value,
+            'Allow new users to self-register via /auth/register'
+        )
+        db.session.commit()
+
+        state_label = 'enabled' if new_value == '1' else 'disabled'
+        log_action(
+            current_user.id,
+            'setting_update',
+            'system_setting',
+            None,
+            f'registration_enabled changed from {old_value} to {new_value} by admin_id={current_user.id}'
+        )
+        logger.info(
+            f'[ADMIN SETTINGS] registration_enabled={new_value} '
+            f'by admin_id={current_user.id} email={current_user.email}'
+        )
+        flash(f'User registration has been {state_label}.', 'success')
+        return redirect(url_for('admin.settings'))
+
+    registration_enabled = SystemSetting.get_bool('registration_enabled', default=True)
+    return render_template('admin/settings.html', registration_enabled=registration_enabled)

app/routes/api.py

@@ -88,8 +88,10 @@ def get_comments(ticket_id):
             'can_delete' : current_user.is_it_staff or c.author_id == current_user.id,
             'attachments': [
                 {
-                    'id'      : a.id,
-                    'filename': a.filename,
+                    'id'       : a.id,
+                    'filename' : a.filename,
+                    'mime_type': a.mime_type or '',
+                    'is_image' : (a.mime_type or '').startswith('image/'),
                 }
                 for a in c.attachments.all()
             ],

app/routes/auth.py

@@ -63,6 +63,12 @@ def register():
     if current_user.is_authenticated:
         return redirect(url_for('tickets.dashboard'))
 
+    from app.models import SystemSetting
+    if not SystemSetting.get_bool('registration_enabled', default=True):
+        logger.info(f'[AUTH REGISTER BLOCKED] Registration is disabled. ip={request.remote_addr}')
+        flash('Self-registration is currently disabled. Please contact your IT administrator.', 'warning')
+        return redirect(url_for('auth.login'))
+
     if request.method == 'POST':
         email      = request.form.get('email', '').strip().lower()
         username   = request.form.get('username', '').strip()

app/routes/tickets.py

@@ -348,9 +348,15 @@ def download_attachment(att_id):
                 f'user_id={current_user.id}'
             )
             abort(403)
-    upload_dir = current_app.config['UPLOAD_FOLDER']
-    return send_from_directory(upload_dir, att.stored_name, as_attachment=True,
-                               download_name=att.filename)
+    upload_dir  = current_app.config['UPLOAD_FOLDER']
+    is_image    = (att.mime_type or '').startswith('image/')
+    return send_from_directory(
+        upload_dir,
+        att.stored_name,
+        as_attachment = not is_image,   # images render inline; other files force-download
+        download_name = att.filename,
+        mimetype      = att.mime_type or None,
+    )
 
 
 # ─── Notifications ────────────────────────────────────────────────────────────