WordPress thinks their users are, Hurr Durr Derp, idiots.
Note: Fix for extra underscores in filenames – post WordPress upload, is at the end of this post, but for your sake read the whole thing because it’s related.
Really. Otherwise WordPress team would let people modify MIME types (which files you are allowed to upload to your media library) easier. Right now it’s, trolololo, in the /wp-includes/functions.php (yes, the 140KB monster function file). Function is absentmindedly called
function get_allowed_mime_types()
and it is a fat-ass PCRE array of random shit that the developers deemed as “safe”.
Yes, they listed WordPerfect extensions such as ‘wp|wpd’ as safe. Random much? No, what I would like to know is why this is hardcoded in the CORE of WordPress and not stored in some configurable list. How is shafting this static array in a functions file helpful to anyone? What if I want to remove this or add a new type?
What’s worse, is that the top 10 solutions returned by Google search are fucking horrible. Apparently, people prefer hacking at the core than extending and whoring hooking WordPress how Zeus intended it.
Please don’t do it. This is horrible, it’s like killing kittens with a chainsaw – unpractical and messy. Instead just use this plugin, PJW Mime Config. It will allow you to add and extend your MIMEs very easily and even detect the types by uploading the file. Sort of useful I guess, but I wouldn’t trust that system blindly; do your research yourself.
PART II
So you added your freaking MIME type. Say it’s the infamous .WTF (WoW Text Files)
And FYI if you add freaking WordPerfect MIME I don’t see why the WTF files are not in my default static list, Mr. WordPress, after all, World of Warcraft has more active users than WordPerfect.
So anyway you added it. Happy happy joy joy, you can now upload the file without the “this file is not secure, try another as if it will help ha-ha-ha” error;
BUT WAIT THERE IS MORE BULLSHIT
Let’s assume your file is named go.wtf Everything went great and you get this:
THEN
You happily modify your file, and rename it. How you name it is nobody’s business, really.
And let’s say you named it like so,
go.new.v21.wtf
Where:
- go (original file name)
- new (signifying that this is the NEW file, lol)
- v21 (where this describes revision number, because SVN is too hard to use)
- wtf (original file extension)
Again, you were lucky to name it so, or similarly. Then you try to upload it and you see this:
You will immediately notice that your file name was changed. I even highlighted it for you.
Where the fuck did this underscore come from?!
I am not the only one, there were other poor souls trying to figure this out.
So, I dreadfully opened formatting.php. God it’s another fucking horrible file. This was more like a bad horror movie when you expect some shit to leap at you from around the corner than debugging.
So I found this little neat function
/**
* Sanitizes a filename replacing whitespace with dashes
*
* Removes special characters that are illegal in filenames on certain
* operating systems and special characters requiring special escaping
* to manipulate at the command line. Replaces spaces and consecutive
* dashes with a single dash. Trim period, dash and underscore from beginning
* and end of filename.
*/
function sanitize_file_name( $filename ) {
....
Notice how function claims to “Sanitize a filename replacing whitespace with dashes“. Not it does not. That motherfucking function fucks up my filename during upload when it has multiple “extensions”, although no, it does not. What it does have, are multiple dot separators.
And then I found this little gem.
// Loop over any intermediate extensions. Munge them with a trailing underscore if they are a 2 - 5 character long alpha string not in the extension whitelist.
foreach ( (array) $parts as $part) {
$filename .= '.' . $part;
if ( preg_match("/^[a-zA-Z]{2,5}\d?$/", $part) ) {
$allowed = false;
foreach ( $mimes as $ext_preg => $mime_match ) {
$ext_preg = '!(^' . $ext_preg . ')$!i';
if ( preg_match( $ext_preg, $part ) ) {
$allowed = true;
break;
}
}
if ( !$allowed )
$filename .= '_';
}
}
HAHAHA WHAT THE FUCK
No seriously. Why? WHY?!
Anyway. I advocated not changing the core, so we will have to hack around this, using aforementioned plugin PJW Mime Config.
Go to your plugin configuration and add, every, single, extension used, in our case it will be NEW:
When you retry the upload you will get the correct naming shown:
Done.
]]>
