Issue
- A multi-extension file is being uploaded via document and media
Steps to reproduce:
1) Startup the server
2) Navigate toControl Panel>System Settings> Document and Media> Services> File Extension
A file extension of * will allow all file extensions by default, however, if the user needs to restrict all types of uploads, they must add specific extensions.Here, to restrict other file types, .png, .jpg, and .txt have been added.
3) Upload the attached [Font.zip.txt] file
Observed Behavior: The portal appears to always accept the last extension of any type of file.
If the .txt extension has been added, the file will be uploaded, however, if this extension is being removed, the file will not be uploaded.
Expected Behavior: The file should not be uploaded since it has two extensions.
Environment
- Liferay DXP 7.4
Resolution
- The observed behavior is the expected behavior of the portal.
- A file extension, also known as a file name extension, is the part of a file that helps operating systems determine the type of file. As a result, this feature's behavior is expected. Starting with the last dot, it specifies the file extension.
test1.txt.mp4 > extension is mp4
test2.txt.mp4.jpg > extension is jpg
- A file extension, also known as a file name extension, is the part of a file that helps operating systems determine the type of file. As a result, this feature's behavior is expected. Starting with the last dot, it specifies the file extension.
Additional Information
-
If users are concerned about any breaches of this feature, they can enable the 'Antivirus Scanning for Uploaded Files', for more information, please see the following documentation: Enabling Antivirus Scanning for Uploaded Files
-
Users who have encountered such concerns, on the other hand, can always contact Liferay support via tickets and provide specific information. This may make it easier to identify this use case as a security risk, in which case the product team will take appropriate action. However, theoretically, it is simply not viable to reevaluate the DMS implemented feature.