Looking at the latest release I don't find this feature (excuse me if it's already planned).

The imagefield should allow admin to define which file types are allowed.

A simple input box with coma separated extensions could be presented to the admin.

Something like :

Label : Allowed image types
Text input box : jpg, gif, jpeg, png
Help : enter a coma separated list of the allowed file extensions. Leave blank to allow anything. The box is already filled with common web image formats.

Is it planned? If not, I can provide a patch for this. Maybe this should be part of a more general file upload validation system. This could also be based on file mime type instead (more complex and relying on the client to send the correct mime type).

The rationale for this is the fact that sometimes you want to restrict the image format submited. For example, we recently had someone upload a BMP file which cannot be scalled down by image cache, ruining the layouts :-).

CommentFileSizeAuthor
#2 imagefield_mimes.patch4.32 KBquicksketch

Comments

quicksketch’s picture

quicksketch
he/him
commented
Assigned: Unassigned » quicksketch

I'm working on this feature request.

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Needs review
StatusFileSize
new imagefield_mimes.patch4.32 KB

Here we are :)

Allowed types:
[gif,png,jpeg] (default)
Only allow images of certain mime types to be uploaded. Enter a comma seperated list of acceptable mime types (such as gif,png,jpeg), or leave blank to allow all images.

This assumes that all image types are 'image/something' mime types. Though the box will accept 'jpg' as a mime type it will be converted to both 'image/jpeg' and 'image/pjpeg' (IE likes to upload progressive jpegs their own mime type). All other mime types must be accurate and are usually their extension.

Please review and let me know if there are any problems. If not mark RTBC.

quicksketch’s picture

quicksketch
he/him
commented

Marked http://drupal.org/node/114944 as duplicate.

philippejadin’s picture

philippejadin commented

Thank you, this is exactly what I was hoping for.

There is maybe a security risk with mime type detection. Mime type can be spoofed by the client, allowing to upload a php file as a image/jpeg file and allow execution of the file by the webserver. See http://php.robm.me.uk/#toc-FileUploads for an explanation.

There are two solutions :

- add the expected extension to the filename (if it's mime/jpeg, add .jpg to the end of the filename if not already there). A file ending with .jpg won't be parsed as php code by the server, even if it contains malicious php code.
- validate the file extension as well (a valid jpg file must end with .jpg or .jpeg and have the correct mime type). Note that some clients operating systems don't provide/rely on file extensions.

Note that in the current module, no check is done, so the security risk is there as well.

As a final note, this should be handled at a higher level in Drupal imho :-) (and maybe it is already)

dopry’s picture

dopry commented
Status: Needs review » Fixed

I committed a variation of this patch to the 5.x-2.x branch. I still have one issue with the ajax... I'd like the form_set_error to appear in the image wrapper, but I can't seem to.. grr.

Thanks for the help on the validation. this will be a fun new rule admin's can enforce.. at least to keep those bmp's out of the way.

.darrel.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)
themselves’s picture

themselves commented

Just a note to make for anyone who is upgrading to the newer (5--2) version in order to get this functionality added, you will have to drill down to the Configure button for the field in your content type, and re-save the configuration for the field before it will start recognizing the file extension limitations. This one caught me for a while ;)