Ticket #50136: 50136.patch

src/wp-includes/ms-functions.php

@@ -1845 +1845 @@
  * @return array
  */
 function check_upload_mimes( $mimes ) {
-        $site_exts  = explode( ' ', get_site_option( 'upload_filetypes', 'jpg jpeg png gif' ) );
-        $site_mimes = array();
-        foreach ( $site_exts as $ext ) {
-                foreach ( $mimes as $ext_pattern => $mime ) {
-                        if ( '' != $ext && false !== strpos( $ext_pattern, $ext ) ) {
-                                $site_mimes[ $ext_pattern ] = $mime;
-                        }
-                }
-        }
-        return $site_mimes;
+    return filter_upload_mimes( $mimes, get_site_option( 'upload_filetypes', 'jpg jpeg png gif' ) );
+}
+
+/**
+ * A helper functions to filter a given list of mime types
+ * against a list of space-separated file extensions.
+ *
+ * File extensions are matched as a full-word. Return value
+ * will contain the passed $mimes array with only allowed
+ * values from $file_types.
+ *
+ * @param array $mimes
+ * @param $file_types
+ * @return array
+ */
+function filter_upload_mimes( array $mimes, $file_types ) {
+    $site_exts  = explode( ' ', $file_types );
+    $site_mimes = array();
+    foreach ( $site_exts as $ext ) {
+        foreach ( $mimes as $ext_pattern => $mime ) {
+            if ( '' != $ext && preg_match('/\b'. preg_quote($ext, '/') .'\b/', $ext_pattern)) {
+                $site_mimes[ $ext_pattern ] = $mime;
+            }
+        }
+    }
+    return $site_mimes;
 }
 
 /**

new file tests/phpunit/tests/multisite/fileUploads.php

@@ +1 @@
+<?php
+
+if ( is_multisite() ) :
+
+    /**
+     * @ticket 50136
+     * @group ms-site
+     * @group multisite
+     */
+    class Tests_Multisite_Upload_Mimes extends WP_UnitTestCase {
+
+        public function test_file_extensions_are_allowed_on_full_match() {
+            $mimes = [
+                'srt|txt|png' => 'foo',
+                'tx' => 'bar',
+                't' => 'baz',
+            ];
+
+            $allowed_mimes = filter_upload_mimes($mimes, 'txt xf rt t');
+            $this->assertTrue(isset($allowed_mimes['srt|txt|png']));
+            $this->assertTrue(isset($allowed_mimes['t']));
+            $this->assertFalse(isset($allowed_mimes['tx']));
+            $this->assertFalse(isset($allowed_mimes['rt']));
+            $this->assertFalse(isset($allowed_mimes['xf']));
+        }
+    }
+
+endif;
+