Only allow images (AllowedFileExtensions doesn't work!)

Macgyver

This discussion is related to the FileUpload addon.

I want users to only be allowed to upload images. I tried adding the following to /conf/conf.php

$Configuration['Garden']['Upload']['AllowedFileExtensions'] = array('jpg','jpeg','gif','png');

This apparently prevents .exe and a few other filetypes to be uploaded, but DOES allow .zip, .pdf? Why? How can I fix this?

Thanks a lot!

x00

now that is very interesting it appears to work with you comment out

$Configuration['Garden']['Upload']['AllowedFileExtensions']... in config-default.php

So it is not taking precedent.

This isn't really the fault of the plugin, it is for some reason the config option is not taking precedent.

You ca create an issue here https://github.com/vanillaforums/Garden/issues

422

Is there a disallowed var ?

Isnt it the other config file ... Default.conf i think you should edit?

Macgyver

Sorry, which file? I don't see default.conf anywhere.

conf.php was mentioned here, someone asked the same question: http://vanillaforums.org/discussion/19558/limit-the-number-of-files-that-can-be-loaded-and-the-file-type-to-only-allow-images-in-fileupload#latest

422

I am mobile so cannot check.

Macgyver

Bump, anyone? This could be a serious security hole!

peregrine

Maybe you should email the developer of the pluginand put the word Security Problem - usually gets their attention.

when I see your screen name @Macgyver, I think of the tv show Macgyver where he could probably fix the plugin with a candle, and a bottlecap

http://en.wikipedia.org/wiki/MacGyver from the wiki

... appeared in a MasterCard television commercial for Super Bowl XL. In it, he manages to cut the ropes binding him to a chair using a pine tree air freshener, uses an ordinary tube sock as the pulley for a zip-line, and somehow repairs and hot-wires a nonfunctional truck using a paper clip, ballpoint pen, rubber band, tweezers, nasal spray, and a turkey baster.

422

The last paragraph, could be coded in jquery json and ajax lol

Macgyver

x00 said: now that is very interesting it appears to work with you comment out

$Configuration['Garden']['Upload']['AllowedFileExtensions']... in config-default.php

So it is not taking precedent.

This isn't really the fault of the plugin, it is for some reason the config option is not taking precedent.

You ca create an issue here https://github.com/vanillaforums/Garden/issues

Great find!