Last modified: 2011-07-18 18:06:51 UTC
Created attachment 8780 [details] Patch that brings UploadBase.php in line with StreamFile.php Greetings. While reviewing another bug report, I noticed the following: On upload, UploadBase's getTitle is called, which validated image file extensions. It checks all of a file's extensions against the blacklist, but only the last extension against the whitelist (iff $wgCheckFileExtensions && $wgStrictFileExtensions, of course). However, StreamFile.php wfGetType checks all of a file's extensions against both lists. This is certainly wrong. Brion said on bug 11142 "Multiple extensions are checked on upload because the web server also checks multiple extensions when it's determining the type of a file to serve out", and so if we want to have StrictFileExtensions actually have any effect, it should really impose its will on every extension, not just one. The attached patch does just that, bringing UploadBase.php in line with StreamFile.php. Of course, the opposite change is also acceptable.
Applied in r92454
