How to implement new "cmb2_{$field_id}_is_valid_img_ext" enhancent

The filter is used in this method and the is_valid_img_ext method is used in the 'file' and 'file_list' field types to determine if the file is an image for a file: https://github.com/WebDevStudios/CMB2/blob/master/includes/CMB2_Types.php#L869-L885

Thanks for the reply Justin.

Yes I saw that, but how would I use this to ensure all file inputs are images?

From the best I can tell, it’s passing in the value in the field, and doing some quick parsing of the value before checking if a determined file extension is in an array of valid image file values. You could do a similar thing as well

CMB2 doesn’t allow you to require only images.. that filter/check is only to determine how to handle files vs images in the file/file_list field types. (Try adding a pdf or something, and you’ll see CMB2 handles it differently). The closest you can get to making it an image field is to change the title/button to indicate an image and to pass the ‘query_args’ parameter which can be used to specify that the media modal should only show images (though it will still let a user upload a non-image file).

$cmb->add_field( array(
	'name' => __( 'Image', 'cmb2' ),
	'id'   => 'image',
	'type' => 'file',
	'query_args'   => array(
		'type' => 'image',
	),
	'options' => array(
		'add_upload_file_text' => 'Add Image',
	),
) );

That’s great thank you Justin.

I have had to enable the upload_files capability for subscribers which feels a bit of a risky but suppose I’ll just have to rely on WordPress to block any noxious file-types!

One thing that still bothers me though is that the subscriber can see ALL the images in the media library, even administrator ones. Do you know if there is any way to block this so they can only see their images?

Boom: cmb2-front-end-wordpress-media-uploader.php

Just make sure to change line 26 from
$subscriber->add_cap( 'manage_options' );
to
$subscriber->add_cap( 'upload_files' );

Thanks Justin…

Are we good to mark this one resolved twobyte?

Well a pedant would say there’s still no real file-type validation, but I’m happy enough so yes.