Make WordPress Core

Opened 5 years ago

Last modified 4 months ago

#54193 new defect (bug)

PHP fileinfo extention identifies JSON as text/plain; wp_check_filetype_and_ext then prevents upload

Reported by: dashifen Owned by:
Priority: normal Milestone: Awaiting Review
Component: Media Version:
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

For hosts that make available the PHP fileinfo extension, uploaded files of mime type application/json are identified by that extension as text/plain. Within the wp_check_filetype_and_ext function, it's noted that "a few common file types are occasionally detected as text/plain", but application/json is not listed as one of those common types. For reference, the following types are listed: csv, rtf, tsv, and vtt.

I propose adding application/json to this list. Otherwise, I believe it may be impossible to upload a JSON file on a host that uses this extension.

Attachments (2)

fileinfo-json-fix.diff​ (386 bytes ) - added by dashifen 5 years ago.
54193.patch​ (292 bytes ) - added by aezazshekh 5 years ago.
Added application/json to this list

Download all attachments as: .zip

Change History (5)

#1 @mukesh27
5 years ago

  • Keywords has-patch needs-refresh added
  • Version 5.8.1

Hi there! thanks for the ticket and patch.

Your patch fileinfo-json-fix.diff​ removed application/json from the file.

Here are a couple of resources to help you get started creating and submitting a patch:

For creating the patch

  • Checkout the master branch (the images show you are on the 5.8 branch)
  • Sync your copy of master to the upstream wordpress/wordpress-develop repo, i.e. by pulling the latest changes from upstream and then merging these changes into your local copy
  • Add the comment change
  • Then svn diff > 54193.diff to create the patch file
  • Then upload that patch file to this ticket

@aezazshekh
5 years ago

Added application/json to this list

#2 @dashifen
5 years ago

Ugh ... I diffed with the branches in the wrong order 😊

Last edited 5 years ago by dashifen (previous) (diff)

This ticket was mentioned in ​PR #12165 on ​WordPress/wordpress-develop by ​@abcd95.


4 months ago
#3

  • Keywords needs-refresh removed

Trac ticket: https://core.trac.wordpress.org/ticket/54193

When the PHP fileinfo extension is active, it occasionally misidentifies uploaded .json files (especially those with simple string structures) as text/plain. Because application/json was not included in the fallback list of safe plain-text types in wp_check_filetype_and_ext(), these uploads were being falsely rejected.

This PR resolves the issue by adding application/json to the array of allowed types when the real MIME type is detected as text/plain. Since JSON is inherently a plain-text format, this is a secure, non-breaking fix that allows users to seamlessly upload JSON files, even on server environments with older libmagic definitions.

Note: See TracTickets for help on using tickets.