0003955: g_disallowed_files only looks for endings

ID	Project	Category	View Status	Date Submitted	Last Update
0003955	mantisbt	attachments	public	2004-06-18 11:13	2014-11-07 15:23

Reporter	Jumar	Assigned To
Priority	normal	Severity	feature	Reproducibility	always
Status	acknowledged	Resolution	open

Summary	0003955: g_disallowed_files only looks for endings
Description	if zip is disabled, you can upload a .zip-file which is renamed to .txt. in the database (table mantis_bug_file_table) stands korrectly: application/x-zip-compressed so for security reasons, it would be better to check the files deeper than only the ending.
Tags	No tags attached.

emm 2007-07-18 06:19 reporter ~0015091	I totally agree with this, and I'd like to add that it would be a great improvement to display the list in g_allowed_files. Because if a user tries to upload a file which extension is disallowed, he need to go back to the page and re-enter all the information! By the way, is this normal? When a field is incorrect, you should not need to re-fill ALL! Maybe I need to enter another mantis for this... Have a good day!