Welcome Guest, Not a member yet? Register   Sign In
why Upload checks Mime types for allowed file types?
#1

[eluser]eroy4u[/eluser]
Why can't Upload just check the extension for allowed file types?

e.g. supposed I set 'ppt' as the allowed file type,
why don't the Upload library check if 'ppt' is the extension of the file,
instead checking 'application/powerpoint'?

as I think some powerpoint maybe of mime type 'application/octet-stream',
so this will make clients not able to upload a '.ppt' file with mime type 'application/octet-stream.

am I right?
#2

[eluser]eroy4u[/eluser]
Do I get something wrong? Please help! Thanks.
#3

[eluser]mglinski[/eluser]
Your confusion is a long standing debate, look in the bug reports section.
For now create your own uploaded file extension checking system.
-Matt
#4

[eluser]aBoy[/eluser]
Hi. Have a look in system/application/config/mimes.php. Smile
#5

[eluser]eroy4u[/eluser]
thanks I've looked into the codes and the Upload library check the mime types only, instead of the extension.

I've also looked in to bugs report, I know how to fix the mimes.php so that '.ppt' files of mime type 'application/octet-stream' can be uploaded.

However, I just don't see the point why the check the mime type instead of the extension. As far as I know, I file named "*.ppt" is a powerpoint and will be opened by powerpoint. Why do i need to check its mime type?
#6

[eluser]gtech[/eluser]
Just because a file is named .ppt does not mean it is a powerpoint presentation. for example if you named a Jpeg image.jpg to image.ppt the file will still be a jpeg. the extension just tells the operation system what application to open when viewing.. if you loaded the image.ppt in a art package the jpeg will still appear.
#7

[eluser]eroy4u[/eluser]
[quote author="gtech" date="1213770172"]Just because a file is named .ppt does not mean it is a powerpoint presentation. for example if you named a Jpeg image.jpg to image.ppt the file will still be a jpeg. the extension just tells the operation system what application to open when viewing.. if you loaded the image.ppt in a art package the jpeg will still appear.[/quote]
thanks a lot, I understand.
so I guess the solution to restrict file types is to check
1. file extension
2. mime type match that extension
but CodeIgniter is not doing this way, it only checks the mime type, if I add "application/octet-stream" to "ppt" in mimes.php,
many file types of mime type "application/octet-stream" can be uploaded!
I think this is a big bug?




Theme © iAndrew 2016 - Forum software by © MyBB