Page MenuHomePhabricator

MP4 upload to Wikimedia Commons not blocked by type checking
Closed, DuplicatePublic

Description

https://commons.wikimedia.org/wiki/File:Test_vc_%282%29.ogv is a MP4.

Full resolution ‎(MP4 audio/video file, AAC/h.264, length 42 s, 1,280 × 720 pixels, 2.12 Mbps overall)

---> Test_vc_(2).ogv: ISO Media, MPEG v4 system, version 2

The error was found when moving file:
Error while moving the page.
API request failed (filetypemismatch): The new file extension doesn't match its type <i>at Sun, 18 Aug 2013 09:28:16 GMT</i> <u>served by mw1196</u>


Version: wmf-deployment
Severity: trivial

Details

Reference
bz52990

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:54 AM
bzimport set Reference to bz52990.
bzimport added a subscriber: Unknown Object (MLST).

So we have stricter type checking on file move then on upload. That's messed up...

It is abusive if everyone can upload by url MP4's...

(In reply to comment #2)

It is abusive if everyone can upload by url MP4's...

No extension for mp4 in mime.types included with mediawiki. Little known fact, any file type that doesn't have an extension listed in mime.types is allowed to be uploaded always.

We should add mp4 to mime.types. its a popular format.

We should also rethink handling of file types with no known extension.

This is pretty trivial. Files are just a pile of bytes, and depending on how those bytes are read by the system, they can pretty much be any file the system wishes them to be. There are already some simple checks in place to ensure that the content of any given file is what the user claims it to be, allowing graphics to be displayed as graphics, and video to be displayed as video. Anything in an incorrect format may then easily be fixed.

(In reply to comment #2)

It is abusive if everyone can upload by url MP4's...

Are you sure this is limited to the "Upload by URL"-feature introduced in bug 20512 ?

(In reply to comment #4)

(In reply to comment #2)

It is abusive if everyone can upload by url MP4's...

No extension for mp4 in mime.types included with mediawiki. Little known
fact,
any file type that doesn't have an extension listed in mime.types is allowed
to
be uploaded always.

But what makes me not be able to upload mp4 @ Special:Upload ?

(In reply to comment #6)

(In reply to comment #2)

It is abusive if everyone can upload by url MP4's...

Are you sure this is limited to the "Upload by URL"-feature introduced in bug
20512 ?

(In reply to comment #4)

(In reply to comment #2)

It is abusive if everyone can upload by url MP4's...

No extension for mp4 in mime.types included with mediawiki. Little known
fact,
any file type that doesn't have an extension listed in mime.types is allowed
to
be uploaded always.

But what makes me not be able to upload mp4 @ Special:Upload ?

Note, I was looking at this from a cell phone well waiting for a flight, so higher probability of me making a mistake.

If my theory is right, there should be nothing stopping you from uploading an mp4 file renamed to have an allowed extension, from special:upload.

(In reply to comment #7)

If my theory is right, there should be nothing stopping you from uploading an
mp4 file renamed to have an allowed extension, from special:upload.

The error message says:

Upload warning
File extension ".jpg" does not match the detected MIME type of the file (video/x-msvideo).

Therefore I am still curious how the mentioned mp4 got on the server.

(In reply to comment #8)

(In reply to comment #7)

If my theory is right, there should be nothing stopping you from uploading an
mp4 file renamed to have an allowed extension, from special:upload.

The error message says:

Upload warning
File extension ".jpg" does not match the detected MIME type of the file
(video/x-msvideo).

video/x-msvideo are .avi files. mp4 files should be identified as video/mp4

Change 79809 had a related patch set uploaded by Brian Wolff:
Add MP4 to mime.types

https://gerrit.wikimedia.org/r/79809

(In reply to comment #9)

video/x-msvideo are .avi files. mp4 files should be identified as video/mp4

Sorry, my mistake. MP4 actually works ( https://commons.wikimedia.org/w/index.php?title=File:M6axmf6t4c9dfux8.mp4.jpg )

Thanks for the patch to fix this.

And: I guess the current mime type detection [1] on the file page is produced by TMH and is therefore unrelated?

example: (MP4 audio/video file, AAC/h.264, length 24 s, 424 × 344 pixels, 183 kbps overall);

(In reply to comment #11)

(In reply to comment #9)

video/x-msvideo are .avi files. mp4 files should be identified as video/mp4

Sorry, my mistake. MP4 actually works (
https://commons.wikimedia.org/w/index.php?title=File:M6axmf6t4c9dfux8.mp4.
jpg )

Thanks for the patch to fix this.

And: I guess the current mime type detection [1] on the file page is produced
by TMH and is therefore unrelated?

example: (MP4 audio/video file, AAC/h.264, length 24 s, 424 × 344 pixels, 183
kbps overall);

Yes. TMH supports mp4. MP4's aren't supposed to be able to get on the server, but once its on the server, TMH correctly handles it.

yep.

  • This bug has been marked as a duplicate of bug 39012 ***

Change 79809 merged by jenkins-bot:
Add MP4 to mime.types

https://gerrit.wikimedia.org/r/79809

kaldari renamed this task from MP4 on Wikimedia Commons to MP4 upload to Wikimedia Commons not blocked by type checking.Jul 21 2020, 10:10 PM