Multi File Upload and restricted filetypes

  • Hey,

    the multi file upload field is not checking the file type restrictions.

    • Add “Multi file upload” Field into your form
    • Set the allowed file types (.pdf, .jpg, .jpeg, .png) in my example
    • Try to upload a file and change in the Explorer Screen (Windows) on the bottom right corner the Filetype Restriction to all Files
    • Upload a XLXM File … and see the world burning in HR

    The single file upload checks the selected file and pops a js alert box.

    Is this the intended way?

    Greetings
    Danny

    [Moderator note: Please, No bumping].

Viewing 2 replies - 1 through 2 (of 2 total)

  • Hey there

    We have the same issue and it’s urgent. We get loads of malware uploads with txt files because of this security issue! Could you deliver us a security patch?

    Kind regards

    Thread Starter support5d

    (@support5d)

    Hey Stefan,

    ich hab in einem anderem Projekt eine API an die Formulare angebunden und prinzipiell k?nnte man mit mit diesem Hook sich einklinken und prüfen was für Dateien übermittelt worden sind. Bevor das Plugin überhaupt etwas davon mitbekommt, ist aber jetzt kein fertiger Code aber ein Entwickler wei? was zu machen w?re.

    Unsere Kunden haben da bisher noch nicht so das Spam Problem gehabt, daher hab ich es noch nicht für n?tig gehalten aktiv einzugreifen.

    Grü?e
    Danny

    
add_action( 'wp_ajax_nopriv_jobslisting_apply_now', 'job_entry_store_tmp_files', 9);
add_action( 'wp_ajax_jobslisting_apply_now', 'job_entry_store_tmp_files', 9);
function job_entry_store_tmp_files(){
	$allowed_file_types = array(
		'png' => 'image/png',
		'jpe' => 'image/jpeg',
		'jpeg' => 'image/jpeg',
		'jpg' => 'image/jpeg',
		'gif' => 'image/gif',
		'tiff' => 'image/tiff',
		'tif' => 'image/tiff',
		'pdf' => 'application/pdf',
		'xlsx' => 'application/vnd.ms-excel',
		'docx' => 'application/msword',
	);
	// Check for files extension and throw error for form
	foreach($_FILES as $key => &$file){
		// Grab MIME type
		$mime_type = mime_content_type($file['tmp_name']);
		if (! in_array($mime_type, $allowed_file_types)) {
			// File type is NOT allowed.
			// Throw Error msg for the the form
		}
	}
}
    • This reply was modified 2 years, 2 months ago by support5d.
    • This reply was modified 2 years, 2 months ago by support5d.
Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Multi File Upload and restricted filetypes’ is closed to new replies.