[PR #48] [CLOSED] Check file extension on rename and creation #884

New issue

Closed

opened 2026-03-02 16:02:09 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 16:02:09 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/prasathmani/tinyfilemanager/pull/48
Author: @CodeFetch
Created: 6/22/2018
Status: ❌ Closed

Base: master ← Head: patch-1

📝 Commits (1)

0b92603 Check file extension on rename and creation

📊 Changes

1 file changed (+17 additions, -3 deletions)

View changed files

📝 tinyfilemanager.php (+17 -3)

📄 Description

The allowed file extensions was only checked on upload.
Thus it is possible to upload a file with a permitted extension and change it to a non-permitted one afterwards.
That renders the „allowed upload file extension“ feature useless.
This commit checks the file extension on file rename and creation attempts, too.

Actually I think this should be reworked completely (I don't have time for that).
Allowed file extensions should be configurable each for:

Directory listing extensions
Read extensions
Edit extensions
Upload/creation/rename extensions

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/prasathmani/tinyfilemanager/pull/48 **Author:** [@CodeFetch](https://github.com/CodeFetch) **Created:** 6/22/2018 **Status:** ❌ Closed **Base:** `master` ← **Head:** `patch-1` --- ### 📝 Commits (1) - [`0b92603`](https://github.com/prasathmani/tinyfilemanager/commit/0b92603bd7c4bd9c7b3eaf644cfaf9f655ddc229) Check file extension on rename and creation ### 📊 Changes **1 file changed** (+17 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `tinyfilemanager.php` (+17 -3) </details> ### 📄 Description The allowed file extensions was only checked on upload. Thus it is possible to upload a file with a permitted extension and change it to a non-permitted one afterwards. That renders the „allowed upload file extension“ feature useless. This commit checks the file extension on file rename and creation attempts, too. Actually I think this should be reworked completely (I don't have time for that). Allowed file extensions should be configurable each for: - Directory listing extensions - Read extensions - Edit extensions - Upload/creation/rename extensions --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>