Admin should not by stopped from uploading any type of file

[foolswisdom]

Admin should not by stopped from uploading any type of file. I tried to upload a .ODT to a test environment as an admin, and where as a .DOC worked, here I received "File type does not meet security guidelines." when using Upload file in Write Post.

Admin's should have unrestricted file uploading.

ENV: trunk 5242

ADDITIONAL DETAILS
2ndary issue, the file I was trying to upload was a .ODT (Open Document Text Format for Office Applications (OpenDocument)) should probably be added to the list of allowed.

[markjaquith]

+1 to both.

[jhodgdon]

I verified the bug report: if you try to upload a file with ODT extension, it fails with the given warning. It is probably more or less version independent, because the "security check" is done in function wp_check_filetype in wp-includes/functions.php, where the file extension is checked against a list of known MIME types, and ODT is not in that list.

However, there is no way the list of MIME types in that function will ever be complete -- there are too many MIME types out there. There is also a plugin hook there (upload_mimes), so anyone wanting to allow new file types can write a plugin to do it. So why choose to add this particular MIME type and not a whole host of others? I am not in favor of adding this particular one, necessarily.

As far as the question of allowing admin to upload whatever file admin wants to, this makes more sense to me, but I think it should be implemented with something like this:

current_user_can( 'override_upload_mimes' )

This would go into function wp_handle_upload in file wp-admin/admin_functions.php, and then of course the admin user would have to be given this permission by default... not sure how to do that...

[Nazgul]

ODT support

[Nazgul]

I've attached 2 patches.

1. Patch which adds the ODT extension to the allowed types.
2. Patch which introduces an unfiltered_upload capability which is only given to administrators by default.

[foolswisdom]

Thanks for the patch Nazgul! After 2.2, I look forward to giving it a spin.

Replying to jhodgdon:

However, there is no way the list of MIME types in that function will ever be complete -- there are too many MIME types out there. There is also a plugin hook there (upload_mimes), so anyone wanting to allow new file types can write a plugin to do it. So why choose to add this particular MIME type and not a whole host of others? I am not in favor of adding this particular one, necessarily.

Who is arguing against adding a whole list of others? All ~popular "safe" extensions should be added.

[rob1n]

+1 to both. I think unfiltered_upload is a good cap to have.

[westi]

+1 to both patches.

BTW for mimetype management there is a nice plugin ;-)

​http://blog.ftwr.co.uk/wordpress/mime-config/

[gerbennn]

Tested both patches with SVN:5292. Works like a charm.

+1 for both patches.

[rob1n]

Refreshed patch refreshed. (fixed typo)

[ryan]

Code looks good. +1 on both.

[rob1n]

(In [5303]) Add unfiltered_upload cap, and allow for admins. Props Nazgul. fixes #4136

[rob1n]

(In [5304]) Add ODT to allowed file types. Props Nazgul. fixes #4136

[technosailor]

This changeset breaks the uploader. GIF and JPG tried as admin, strips the . in the filename (i.e. mysexypic.jpg becomes mysexypicjpg). I'll try to get in a patch tomorrow if I have a minute or can track down the issue. Don't wait on me though. I'd roll back this changeset until the bug can be fixed.

[technosailor]

Ok, here's a diff. All this does is allow an admin to upload a valid mimetype image without the stripping of the dot between filename and ext. Non-admin users will still have valid filenames mangled which is exactly opposite of how it was with the previous changeset. I spent some time reviewing mods to wp-admin/admin-functions.php and wp-includes/functions.php in SVN and I can't really determine where this greedy stripping is occurring.

Regardless, I'm reopening as I don't believe this is expected behavior. If we don't want non-admins to upload images, let's take away the uploader - not change their files behind their backs. If we DO want to allow non-admins to upload images, then my changeset does not address this issue and we need to find out where those greedy regexes (or whatever) are mangling the files.

[Nazgul]

I did some testing.

The greedy stripping is done by sanitize_title_with_dashes, because wp_check_filetype isn't called and therefore $ext isn't set.

The attached patch makes sure wp_check_filetype is called, and sets the $ext manually if it's an unknown filetype and the user can do unfiltered_upload.

[technosailor]

That's the solution I was trying to find. I just wasn't putting all the pieces together. Suggest commit. :) Well done, Nazgul.

[ryan]

(In [5353]) unfiltered_upload fix from Nazgul. fixes #4136