CodeIgniter Forums
why Upload checks Mime types for allowed file types? - Printable Version

+- CodeIgniter Forums (https://forum.codeigniter.com)
+-- Forum: Archived Discussions (https://forum.codeigniter.com/forum-20.html)
+--- Forum: Archived Development & Programming (https://forum.codeigniter.com/forum-23.html)
+--- Thread: why Upload checks Mime types for allowed file types? (/thread-9191.html)



why Upload checks Mime types for allowed file types? - El Forum - 06-16-2008

[eluser]eroy4u[/eluser]
Why can't Upload just check the extension for allowed file types?

e.g. supposed I set 'ppt' as the allowed file type,
why don't the Upload library check if 'ppt' is the extension of the file,
instead checking 'application/powerpoint'?

as I think some powerpoint maybe of mime type 'application/octet-stream',
so this will make clients not able to upload a '.ppt' file with mime type 'application/octet-stream.

am I right?


why Upload checks Mime types for allowed file types? - El Forum - 06-16-2008

[eluser]eroy4u[/eluser]
Do I get something wrong? Please help! Thanks.


why Upload checks Mime types for allowed file types? - El Forum - 06-16-2008

[eluser]mglinski[/eluser]
Your confusion is a long standing debate, look in the bug reports section.
For now create your own uploaded file extension checking system.
-Matt


why Upload checks Mime types for allowed file types? - El Forum - 06-16-2008

[eluser]aBoy[/eluser]
Hi. Have a look in system/application/config/mimes.php. Smile


why Upload checks Mime types for allowed file types? - El Forum - 06-17-2008

[eluser]eroy4u[/eluser]
thanks I've looked into the codes and the Upload library check the mime types only, instead of the extension.

I've also looked in to bugs report, I know how to fix the mimes.php so that '.ppt' files of mime type 'application/octet-stream' can be uploaded.

However, I just don't see the point why the check the mime type instead of the extension. As far as I know, I file named "*.ppt" is a powerpoint and will be opened by powerpoint. Why do i need to check its mime type?


why Upload checks Mime types for allowed file types? - El Forum - 06-17-2008

[eluser]gtech[/eluser]
Just because a file is named .ppt does not mean it is a powerpoint presentation. for example if you named a Jpeg image.jpg to image.ppt the file will still be a jpeg. the extension just tells the operation system what application to open when viewing.. if you loaded the image.ppt in a art package the jpeg will still appear.


why Upload checks Mime types for allowed file types? - El Forum - 06-17-2008

[eluser]eroy4u[/eluser]
[quote author="gtech" date="1213770172"]Just because a file is named .ppt does not mean it is a powerpoint presentation. for example if you named a Jpeg image.jpg to image.ppt the file will still be a jpeg. the extension just tells the operation system what application to open when viewing.. if you loaded the image.ppt in a art package the jpeg will still appear.[/quote]
thanks a lot, I understand.
so I guess the solution to restrict file types is to check
1. file extension
2. mime type match that extension
but CodeIgniter is not doing this way, it only checks the mime type, if I add "application/octet-stream" to "ppt" in mimes.php,
many file types of mime type "application/octet-stream" can be uploaded!
I think this is a big bug?