[wp-trac] [WordPress Trac] #50136: Files types not included in Upload file types are allowed to be uploaded because of loose file extension check

[WordPress Trac]

#50136: Files types not included in Upload file types are allowed to be uploaded
because of loose file extension check
--------------------------+------------------------------
 Reporter:  Nikschavan    |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Upload        |     Version:
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  multisite
--------------------------+------------------------------

Comment (by ayeshrajans):

 Thank you @dd32 - I also think the regex will make things cleaner. I don't
 know if we can get the file name passed to the `check_upload_mimes`
 function, because it looks like this function is supposed to return an
 allow-list of file mimes from the configuration, and functionality down
 stream will check the extension.

 `check_upload_mimes` function takes a list of mime types as a parameter,
 but fetches the allowed file extensions from the database. This makes it
 not possible to unit test it, so I refactored it to `filter_upload_mimes`
 function that takes array of mimes _and_ the allowed extensions as a
 string.

 I will upload another patch to fix the missing case-insensitive flag in
 the first patch. Thank you.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/50136#comment:6>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform