Image module lets you upload non-image extentions as default picture.

The reported behavior can be reproduced under 7.x and 8.x

Steps to reproduce:
go to admin/structure/types/manage/article/fields/field_image
in the Default Image field, select a file with an extension .txt and upload.
Expected behavior:
Upload is denied for non-image file type.
Observed behavior:
text file is uploaded as default image.

The file system gets a crack a upload validation before it goes on to image, and probably that is as it should be, so the comment
"It is checked by the file module and not by the image module as it should be"
is maybe misleading, should be more like
"should be checked by the image module in addition to the file module check"

(The file module will restrict the upload to jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp on a default installation.)

It seems like a valid solution to refactor image_field_widget_form (also in image.field.inc) to make the extension validation used there available to function image_field_settings_form.

    // If not using custom extension validation, ensure this is an image.
    $supported_extensions = array('png', 'gif', 'jpg', 'jpeg');
    $extensions = isset($elements[$delta]['#upload_validators']['file_validate_extensions'][0]) ? $elements[$delta]['#upload_validators']['file_validate_extensions'][0] : implode(' ', $supported_extensions);
    $extensions = array_intersect(explode(' ', $extensions), $supported_extensions);
    $elements[$delta]['#upload_validators']['file_validate_extensions'][0] = implode(' ', $extensions);

Perhaps another direction, there is a discussion over at http://drupal.org/node/959800 demonstrates validation based on mime type rather than extension...

Turns out that no refactoring is required, just needed to patch up the plumbing: setting #upload_validators and #file_validate_extensions for the default_image form element. (The actual validation takes place in node.js, and that is unchanged.)

After patch
go to admin/structure/types/manage/article/fields/field_image
in the Default Image field, select a file with an extension .txt and upload.
Expected behavior:
Upload is denied for non-image file type.
Observed behavior is as expected.

This patch applies cleanly on 8.x at 5be3d55
As things stand, the 7.x backport would be same except for file structure.

I tested the patch before and after and can verify that before I was allowed to set .txt file as default and after I received the expected error message that notified me of the allowed content types. Looks good to me!

Nice bug fix! Let's get a test for this.

+++ b/core/modules/image/image.field.incundefined
@@ -61,8 +61,10 @@ function image_field_settings_form($field, $instance) {
+    '#upload_validators' => array('png', 'gif', 'jpg', 'jpeg'),

Shouldn't this be: '#upload_validators' => array('file_validate_extensions' => array('png', 'gif', 'jpg', 'jpeg')), or file_field_widget_upload_validators($field, $instance),

+++ b/core/modules/image/image.field.incundefined
@@ -61,8 +61,10 @@ function image_field_settings_form($field, $instance) {
+    '#file_validate_extensions'  => file_field_widget_upload_validators($field, $instance),

Also, what's this about? I can't find any mention of #file_validate_extensions in Drupal core.

I guess as stated in #7, no need of mentioning file extensions manually rather than just lettings 'file' module handle it?
I have attached the modified patch. Thought to make my first test patch for this but no luck :(

Thanks

Applied and tested patch #8 and it works.

While patch does it's job, there's still no test coverage.
Could you add a case for testing this behavior. It should fail without applying patch, and pass with applied patch

While trying to see if I could create the requested simpleTest cases, I noticed that with the patch applied, I get the appropriate error message when I load test.txt in the file upload button at:

/admin/structure/types/manage/article/fields/node.article.field_image

But I do not get the error if I do the upload from:

/admin/structure/types/manage/article/fields/node.article.field_image/field

On the other hand, in the second case, once I press "Save field settings", the badly named uploaded file is silently discarded.

I'm ready to review this. Can you add the test requested in #6? Thanks.

I tested this on Drupal 9.3.x, standard install and when I tried to upload a .pdf as the default image the following error message, which included the correct allowed file extension, was displayed. "The selected file test.pdf cannot be uploaded. Only files with the following extensions are allowed: png, gif, jpg, jpeg."

Therefore, closing as cannot reproduce. If you are experiencing this problem reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue (starting from "Install Drupal core").

Thanks!