Files and file uploads: $wgFileBlacklist
Files with these extensions will never be allowed as uploads.
Introduced in version:1.2.0
Removed in version:1.37.0 (Gerrit change 680806; git #4dae3b1a)
Allowed values:(array)
Default value:(see below)
Other settings: Alphabetical | By function

Details

Files with these extensions will never be allowed as uploads.

$wgFileBlacklist overrides $wgFileExtensions, so you must remove an extension from the blacklist before you can upload files that have it. For instance, to allow users to upload executables, add this to LocalSettings.php:

$wgFileExtensions[] = 'exe';
$wgFileBlacklist = array_diff( $wgFileBlacklist, array ('exe') );
$wgMimeTypeBlacklist = array_diff( $wgMimeTypeBlacklist, array ('application/x-msdownload') );

Default values

MediaWiki versions:
1.33 – 1.36
 
/**
 * Files with these extensions will never be allowed as uploads.
 * An array of file extensions to blacklist. You should append to this array
 * if you want to blacklist additional files.
 */
$wgFileBlacklist = [
	# <translate nowrap><!--T:7--> HTML may contain cookie-stealing JavaScript and web bugs</translate>
	'html', 'htm', 'js', 'jsb', 'mhtml', 'mht', 'xhtml', 'xht',
	# <translate nowrap><!--T:8--> PHP scripts may execute arbitrary code on the server</translate>
	'php', 'phtml', 'php3', 'php4', 'php5', 'phps', 'phar',
	# <translate nowrap><!--T:9--> Other types that may be interpreted by some servers</translate>
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# <translate nowrap><!--T:10--> May contain harmful executables for Windows victims</translate>
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' ];
MediaWiki versions:
1.16 – 1.32
 
$wgFileBlacklist = [
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb', 'mhtml', 'mht', 'xhtml', 'xht',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'php5', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' ];
MediaWiki versions:
1.11 – 1.15
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb', 'mhtml', 'mht',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'php5', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki versions:
1.8 – 1.10
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'php5', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki version:
1.7
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki version:
1.6
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb', 'svg',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki version:
1.5
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm', 'js', 'jsb',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki version:
1.4
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	'html', 'htm',
	# PHP scripts may execute arbitrary code on the server
	'php', 'phtml', 'php3', 'php4', 'phps',
	# Other types that may be interpreted by some servers
	'shtml', 'jhtml', 'pl', 'py', 'cgi',
	# May contain harmful executables for Windows victims
	'exe', 'scr', 'dll', 'msi', 'vbs', 'bat', 'com', 'pif', 'cmd', 'vxd', 'cpl' );
MediaWiki versions:
1.2 – 1.3
 
$wgFileBlacklist = array(
	# HTML may contain cookie-stealing JavaScript and web bugs
	"html", "htm",
	# PHP scripts may execute arbitrary code on the server
	"php", "phtml", "php3", "php4", "phps",
	# Other types that may be interpreted by some servers
	"shtml", "jhtml", "pl", "py",
	# May contain harmful executables for Windows victims
	"exe", "scr", "dll", "msi", "vbs", "bat", "com", "pif", "cmd", "vxd", "cpl" );

See also

  • Manual:$wgFileExtensions
  • Manual:$wgMimeTypeBlacklist
  • Manual:MIME type detection
  • The filename-prefix-blacklist system message defines prohibited prefixes, to avoid non-descriptive (usually camera-generated) filenames.
This article is issued from Mediawiki. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.