amit.ray1 wrote:

see patch in 'function verify( $tmpfile, $extension )'

attachment SpecialUpload.php ignored as obsolete

Downgrading status from blocker.

(In reply to comment #1)

Created an attachment (id=6090) [details]
see patch in 'function verify( $tmpfile, $extension )'

Please submit a real patch in unified diff format.

Created attachment 6291
Patch of above file to trunk

Here's a diff of patching the above file into trunk. That being said, I won't commit it.

It's a nasty hack with a very easily exploitable vector: rename any file to one of the MSFT files, and you skip all of Tim's content-detection work.

Attached:

Patch for mime.types to allow MS Office 2007 doc types

This problem could also be fixed by patching the includes/mime.types file to identify the MS 2007 Office docs (see attached patch). If someone will assign to me, I would be glad to fix and submit.

Attached:

Bryan.TongMinh wrote:

Looks ok.(In reply to comment #5)

Created an attachment (id=6403) [details]
Patch for mime.types to allow MS Office 2007 doc types

This problem could also be fixed by patching the includes/mime.types file to
identify the MS 2007 Office docs (see attached patch). If someone will assign
to me, I would be glad to fix and submit.

Looks ok.

Committed to revision 56923