Make WordPress Core

Opened 3 years ago

Closed 7 weeks ago

Last modified 7 weeks ago

#22403 closed defect (bug) (fixed)

Prevent default browser behavior with Plupload disallowed file extensions

Reported by: nacin Owned by: azaozz
Milestone: 4.4 Priority: normal
Severity: normal Version: 3.3
Component: Upload Keywords: has-patch
Focuses: Cc:


See #22149. When Plupload is set to accept only certain file types, the drag event falls back to the browser's default behavior. That means HTML files replace the entire viewport, ZIP files get re-downloaded, etc. Ideally, our own handlers intercept such a drag event and prevents anything else from happening.

Attachments (1)

22403.diff (580 bytes) - added by antpb 2 months ago.

Download all attachments as: .zip

Change History (7)

#1 @kovshenin
3 years ago

  • Cc kovshenin added

#2 @chriscct7
3 months ago

  • Keywords needs-patch added
  • Priority changed from low to normal
  • Severity changed from minor to normal

#3 @antpb
2 months ago

  • Keywords has-patch added; needs-patch removed
  • Milestone changed from Future Release to 4.4

We could add some jQuery to the admin-header file to disallow drag and drop events. The following patch fixes it. I've tested the media upload page's drag and drop feature after applying the patch and this does not overwrite the functionality.

2 months ago

#4 @wonderboymusic
2 months ago

  • Owner set to azaozz
  • Status changed from new to assigned

#5 @azaozz
7 weeks ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 35019:

Plupload: update to 2.1.8. Changelog: https://github.com/moxiecode/plupload/releases.

Hide the editor uploader overlay on all drop events in the window, not only when dropping on the editor uploader element.

Fixes #34251, #22403.

#6 @azaozz
7 weeks ago

Fixed by updating to Plupload 2.1.8. It properly fires the error event and prevents the default when a file extension is rejected.

Last edited 7 weeks ago by azaozz (previous) (diff)
Note: See TracTickets for help on using tickets.