Extra Field File Upload - Not filtering by extension

[nexmation]

I have an extra field called "video"
I have it set to allow the following file types: mpg,mpeg,wmv,flv,mov,

However, if a user tries to upload a jpg file, gif, etc... it is still getting uploaded to the video field.

Is there a way to make sure that the upload type checking actually works?

[Eric Barnes]

It sounds like you may be getting a javascript error on that page.

Can you check with Firefox and see if you see any javascript warnings or errors?

[nexmation]

Actually what I think is happening is when a user doesn't have javascript turned on in their browser is when the problem can happen.

I tried to upload a non approved file extension and was greeted with a javascript warning box telling me to use the correct file type. But I've had a bunch of users that have managed to accidentally upload jpegs where only video files should be allowed.

[Eric Barnes]

You may want to add this as a bug in the issue tracker:
http://www.68classifieds.com/forums/project.php

That way I remember it and can add server side checking.

[nexmation]

OK, I tested this with javascript turned off, and with no javascript, it uploaded a file with an unsupported file extension.

So it looks like the only check being done on the file uploads is with javascript, and nothing in the backend php script.

This is a HUGE security issue, because all a hacker has to do to upload a restricted file type is to turn off javascript.


It is also is a major PITA for a site administrator since a lot of regular people leave javascript turned off in their browsers.

[Eric Barnes]

That is why I said to file a bug report.

[nexmation]

Done:
http://www.68classifieds.com/forums/...hp?issueid=184

[Eric Barnes]

Thank you!