Upload specific file extensions not possible

Resolved wittigdocs
(@wittigdocs)

7 years, 9 months ago

I try to upload XML files. XML extensions and many others are blocked according https://www.iptanus.com/wordpress-file-upload-security-comprehensive-study/ I found the implementation of black- and whitelist in wfu_security.php

If I put uploadpatterns="*.xml" into the shortcode, XML is still not allowed to upload. (even uploadpatterns="*.*" does not upload XML)
When I modify wfu_security.php then XML is able to upload.
My question: Is this by design? Do I always need to modify your source to be able to upload xml-files? Is there an advised solution for this?

https://wordpress.org/plugins/wp-file-upload/

Viewing 4 replies - 1 through 4 (of 4 total)

Plugin Author nickboss
(@nickboss)

7 years, 9 months ago
Hi, .xml files are black-listed. There is a workaround that you can actually use to remove this restriction.

If you have the free version, just add the following code inside functions.php:
```
global $wfu_extension_blacklist;
if ( isset($wfu_extension_blacklist["xml"]) ) unset($wfu_extension_blacklist["xml"]);
```
If you have the Pro version, you can add a Hook from the plugin’s page in Dashboard and put the above code inside.

Try it and let me know if it works.

Nickolas
Thread Starter wittigdocs
(@wittigdocs)

7 years, 9 months ago
Thank you; it worked partly but not finally.
1. Since I sit on a theme-independent plugin, the functions.php is not a solution for me. I put your code into the plugin main file:
```
function dif_wp_upload_blacklist() {
	global $wfu_extension_blacklist;
	if (isset($wfu_extension_blacklist['xml'])) {
		unset($wfu_extension_blacklist['xml']);
	}}
add_action( 'after_setup_theme', 'dif_wp_upload_blacklist' );
```
2. XML files can still not uploaded as long as they are not in the $whitelist of wfu_security.php. Unfortunately the latter array is private, so the above approach for the blacklist does not work for the whilelist:
global $whitelist; $whitelist['xml'] = 1;
If I put ‘”xml”=>1` manually into the array in file wfu_security.php the upload works.
Plugin Author nickboss
(@nickboss)

7 years, 9 months ago

You do not need to change the whitelist. Just set uploadpatterns=”*.xml” inside the shortcode, to declare that you want xml files to be allowed.

Try it and let me know

Nickolas

Thread Starter wittigdocs
(@wittigdocs)

7 years, 9 months ago

Yes, now it works to upload “forbidden” files without modifying the plugin-code.
For the whitelist uploadpatterns="*.* did not work. But uploadpatterns="*.*, *.xml works.
Thank you.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Upload specific file extensions not possible’ is closed to new replies.

Tags