Configurable allowed file extensions
Bèr Kessels - January 28, 2007 - 15:43
| Project: | Flexinode |
| Version: | 4.7.x-1.x-dev |
| Component: | Field type: file |
| Category: | task |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | needs review |
Description
Introduce file extensions config options.
My personal preference, however, is checks for mime-types, instead of extensions. Mime types are technically superior, modern desktop environments no longer use extensions (or at least don't care about them).
#1
The patch presented here forces siteadmins to whitelist allowable extensions in order to prevent security issues.
Mime-types are nice and all, but AFAIK local files don't really tell what mime-type they have when they are uploaded.
#2
Attached patch is derived from the patch I mentioned. Allowing just any file to be uploaded is insecure, so this patch should go in ASAP.
#3
#4
#5
I hate bumping this issue like this, but can anybody at least review this patch?
It's an important security improvement.