Correction to fix for bug 3641: don't reject on all unrecognized files

which we happen to know an extension -> mime type mapping for. Just do
it for those which can be detected from content by getimagesize() for now.

diff --git a/includes/MimeMagic.php b/includes/MimeMagic.php
index 5be0ee6..d720412 100644 (file)
--- a/includes/MimeMagic.php
+++ b/includes/MimeMagic.php
@@ -304,6 +304,27 @@ class MimeMagic {
                return in_array( $mime, $types );
        }
        
+       /**
+        * Returns true if the extension represents a type which can
+        * be reliably detected from its content. Use this to determine
+        * whether strict content checks should be applied to reject
+        * invalid uploads; if we can't identify the type we won't
+        * be able to say if it's invalid.
+        *
+        * @todo Be more accurate when using fancy mime detector plugins;
+        *       right now this is the bare minimum getimagesize() list.
+        * @return bool
+        */
+       function isRecognizableExtension( $extension ) {
+               static $types = array(
+                       'gif', 'jpeg', 'jpg', 'png', 'swf', 'psd',
+                       'bmp', 'tiff', 'tif', 'jpc', 'jp2',
+                       'jpx', 'jb2', 'swc', 'iff', 'wbmp',
+                       'xbm'
+               );
+               return in_array( strtolower( $extension ), $types );
+       }
+       
        
        /** mime type detection. This uses detectMimeType to detect the mim type of the file,
        * but applies additional checks to determine some well known file formats that may be missed

diff --git a/includes/SpecialUpload.php b/includes/SpecialUpload.php
index 06b79a7..995e6b5 100644 (file)
--- a/includes/SpecialUpload.php
+++ b/includes/SpecialUpload.php
@@ -755,11 +755,11 @@ class UploadForm {
                $magic =& wfGetMimeMagic();
 
                if ( ! $mime || $mime == 'unknown' || $mime == 'unknown/unknown' )
-                       if ( ! $magic->getTypesForExtension( $extension ) ) {
-                               wfDebug( "$fname: passing file with unknown mime type and unknown extension\n" );
+                       if ( ! $magic->isRecognizableExtension( $extension ) ) {
+                               wfDebug( "$fname: passing file with unknown detected mime type; unrecognized extension '$extension', can't verify\n" );
                                return true;
                        } else {
-                               wfDebug( "$fname: rejecting file with unknown mime type but known extension\n" );
+                               wfDebug( "$fname: rejecting file with unknown detected mime type; recognized extension '$extension', so probably invalid file\n" );
                                return false;
                        }