Ticket #22149: 22149.2.diff

wp-admin/custom-header.php

@@ -763 +763 @@
          */
         function step_2_manage_upload() {
                 $overrides = array('test_form' => false);
-                $file = wp_handle_upload($_FILES['import'], $overrides);
 
+                $file = $_FILES['import'];
+                $wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], false );
+                if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+                        wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+                $file = wp_handle_upload($file, $overrides);
+
                 if ( isset($file['error']) )
                         wp_die( $file['error'],  __( 'Image Upload Error' ) );
 

wp-admin/custom-background.php

@@ -358 +358 @@
 
                 check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
                 $overrides = array('test_form' => false);
-                $file = wp_handle_upload($_FILES['import'], $overrides);
 
+                $file = $_FILES['import'];
+                $wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], false );
+                if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+                        wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+                $file = wp_handle_upload($file, $overrides);
+
                 if ( isset($file['error']) )
                         wp_die( $file['error'] );