contao/test — Issue #2655: check mime types on upload (frontend)
Author: importer
Created: 2011-11-29 10:03:00+00:00
State: open
Labels: Feature, frontend

Hi.
Seems contao didn't check mime type when upload files from frontend, it only check a file extension.
So I can upload any file, only give him allowed extension.

for example - set jpg as allowed extension, rename any text file to XXX.jpg and try to upload - it will successfully uploaded.

I think you should add something like this to FormFileUpload.php . Note: please change warning message.

```
$info = getimagesize($file['tmp_name']);
$mime = image_type_to_mime_type($info[2]);
if (!in_array($mime, $GLOBALS['TL_CONFIG']['ALLOWED_MIME_TYPES']))
{
$this->addError(sprintf($GLOBALS['TL_LANG']['ERR']['filetype'], $pathinfo['extension']));
$this->log('File type "'.$pathinfo['extension'].'" is not allowed to be uploaded ('.$file['name'].')', 'FormFileUpload validate()', TL_ERROR);

unset($_FILES[$this->strName]);
return;

}
```

--- _Originally created by dmitry on November 3rd, 2010, at 01:10pm (ID 2655)_