Opened 95 minutes ago
Last modified 85 minutes ago
#66419 new defect (bug)
Font Library: TTF uploads are rejected when fileinfo reports font/ttf
| Reported by: | dhrupo | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Upload | Version: | trunk |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
WP_Font_Utils::get_allowed_font_mime_types() expects TrueType fonts to be detected as font/sfnt. libmagic reports them as font/ttf since file 5.47 (https://github.com/file/file/commit/6481672a8e), so wp_check_filetype_and_ext() rejects the upload with rest_font_upload_invalid_file_type.
This affects PHP builds that use a newer libmagic: PHP 8.6 bundles libmagic 5.48, and distribution builds that link the system libmagic can be affected on older PHP versions too.
Results for tests/phpunit/data/fonts/OpenSans-Regular.ttf:
| detector | result |
|---|---|
PHP 8.5.12 finfo (bundled libmagic 5.46) | font/sfnt
|
| upstream libmagic master (with the fix below) | font/ttf
|
PHP 8.6.0-dev finfo (bundled libmagic 5.48) | application/octet-stream
|
The application/octet-stream result on PHP 8.6 is an upstream libmagic regression, fixed in https://github.com/file/file/commit/ba72caa54b and reported to PHP in https://github.com/php/php-src/issues/25051. Once PHP takes that fix, TTF files are detected as font/ttf, and the upload is still rejected.
Tests_REST_WpRestFontFacesController::test_create_item_with_multiple_font_files fails on PHP 8.6.0-dev and passes on PHP 8.5.
Suggested fix: during font uploads, accept a .ttf file detected as either font/sfnt or font/ttf. A PHP version check alone would miss builds that use the system libmagic.
Change History (2)
This ticket was mentioned in PR #15204 on WordPress/wordpress-develop by @dhrupo.
86 minutes ago
#1
- Keywords has-patch has-unit-tests added
#2
@
85 minutes ago
PR: https://github.com/WordPress/wordpress-develop/pull/15204
With the PR, a .ttf upload detected as font/sfnt or font/ttf is accepted during font uploads; application/octet-stream and other extensions stay rejected. New tests pass on PHP 7.4, 8.5 and 8.6, and --group font-library passes on 7.4 and 8.5. test_create_item_with_multiple_font_files will pass on PHP 8.6 once PHP takes the libmagic fix from https://github.com/php/php-src/issues/25051.
Use of AI tools: I used Claude Code (Claude Opus 5.5) to find this by running the test suite on PHP 8.6 and to write the change and tests. I reviewed every line and checked the results myself.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
libmagic detects TrueType fonts as
font/ttfsince file 5.47, whileWP_Font_Utils::get_allowed_font_mime_types()expectsfont/sfnt, so TTF uploads to the Font Library are rejected withrest_font_upload_invalid_file_type. PHP 8.6 bundles libmagic 5.48, and builds that link the system libmagic can use a newer one on older PHP versions.This adds
WP_Font_Utils::allow_ttf_mime_types()onwp_check_filetype_and_extduring font uploads only, next to the existingupload_mimesfilter. It accepts a.ttffile detected as eitherfont/sfntorfont/ttf.application/octet-streamand other extensions stay rejected.Testing
Tests_Fonts_WpFontUtils_AllowTtfMimeTypes(--group 66419): fail on trunk (method missing),OK (7 tests, 9 assertions)on PHP 7.4.33, 8.5.12 and 8.6.0-dev.--group font-library:OK (204 tests, 919 assertions)on PHP 7.4.33 and 8.5.12.test_create_item_with_multiple_font_filesstill fails: that build reports TTF asapplication/octet-streambecause of an upstream libmagic regression (fixed in file/file@ba72caa54b, reported in php/php-src#25051). With the upstream fix the result isfont/ttf, which this change accepts.Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Finding the issue by running the test suite on PHP 8.6, writing the change and tests, and running the checks above. I reviewed every line and checked the results myself.