Opened 3 years ago
Last modified 2 years ago
#54433 assigned defect (bug)
ALLOW_UNFILTERED_UPLOADS does not work anymore
Reported by: |
|
Owned by: | |
---|---|---|---|
Milestone: | Awaiting Review | Priority: | normal |
Severity: | normal | Version: | 5.8.2 |
Component: | Media | Keywords: | |
Focuses: | Cc: |
Description
I previously added
define( 'ALLOW_UNFILTERED_UPLOADS', true );
to wp-config.php so that I could upload binary executable into the media library. These executable files are installers for the software my lab develops and which is used by thousands of users around the world.
As I am trying to release a new version I tried to upload the new installers and no matter what I do I get "Sorry, this file type is not permitted for security reasons".
I really see no reason why the site admin should be prevented to upload something into his own site.
I am using version 5.8.2 of wordpress which does not appear in the Version pull down below, and Avada and a multisite installation.
Attachments (2)
Change History (6)
#1
@
3 years ago
- Component changed from General to Media
- Focuses administration multisite removed
- Version trunk deleted
#4
@
2 years ago
Hi and thanks for the report!
You apparently found a way around this (maybe the plugin mentioned in your support topic).
I found a discrepancy between upload locations. I tried this in a single-site WordPress 6.1.1 installation just with the constant in wp-config
, with and without the upload_mimes
filter in a must-use plugin (not the theme). I was able to upload an EXE file and your ADFRsuite_Linux-x86_64_1.0_install
file when I went to the "Add New" page (in the side menu or clicking the "Add New" link at the top in List mode).
However, the inline uploader—above the media thumbnails in Grid mode—blocked the Linux installation file as an unsupported type, either with or without the filter. Using the upload_mimes
filter made it accept the EXE file.
Hello
So what is happening with this ?
Why it is that a site administrator cannot upload a file ? This makes no sense to me.
my wp-config.php file contains
define('ALLOW_UNFILTERED_UPLOADS',true);
and my wp-content/themes/Avada/functions.php fiel contains
the .wps extension (i.e WordPress Sucks) was added as it is the only way I found to upload linux binaries, by adding the .wps extension ...
thanks