Skip to content

Restrict file types for imports. (#2327) #2328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
melaniekung wants to merge 2 commits into
base: qa/2.x
Choose a base branch
from
Open

Restrict file types for imports. (#2327) #2328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1381186
Restrict file types for imports. (#2327)
melaniekung Mar 30, 2026
dde3b0e
Add post submit file extension check
melaniekung Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion apps/qubit/modules/object/actions/importSelectAction.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,13 @@ protected function doBackgroundImport($request)
$this->redirect($importSelectRoute);
}

// Redirect user if they are attempting to upload an invalid CSV file
// Redirect user if they are attempting to upload an invalid CSV/XML file
if ('xml' == $importType && 'xml' !== strtolower(pathinfo($file['name'], PATHINFO_EXTENSION))) {
$errorMessage = $this->context->i18n->__('Not an XML file.');
$this->context->user->setFlash('error', $errorMessage);
$this->redirect($importSelectRoute);
}

if ('csv' == $importType && !$this->checkForValidCsvFile($request, $file['tmp_name'])) {
$errorMessage = $this->context->i18n->__('Not a CSV file (or CSV columns not recognized).');
$this->context->user->setFlash('error', $errorMessage);
Expand Down
8 changes: 7 additions & 1 deletion apps/qubit/modules/object/actions/validateCsvAction.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,12 @@ protected function doBackgroundValidate($request)
$this->redirect($validateCsvRoute);
}

if ('csv' !== strtolower(pathinfo($file['name'], PATHINFO_EXTENSION))) {
$errorMessage = $this->context->i18n->__('Not a CSV file.');
$this->context->user->setFlash('error', $errorMessage);
$this->redirect($validateCsvRoute);
}

// if we got here without a file upload, go to file selection
if (0 == count($file) || empty($file['tmp_name'])) {
$this->redirect($validateCsvRoute);
Expand All @@ -83,7 +89,7 @@ protected function doBackgroundValidate($request)
// Choose import type based on importType parameter
// This decision used to be based in the file extension but some users
// experienced problems when the extension was omitted
'importType' => $importType,
'importType' => 'csv',
'file' => $file,
];

Expand Down
3 changes: 2 additions & 1 deletion apps/qubit/modules/object/templates/importSelectSuccess.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,8 +158,9 @@
<div id="file-collapse" class="accordion-collapse collapse show" aria-labelledby="file-heading">
<div class="accordion-body">
<div class="mb-3">
<?php 'csv' == $type ? $acceptedType = '.csv' : $acceptedType = '.xml'; ?>
<label for="import-file" class="form-label"><?php echo __('Select a file to import'); ?></label>
<input class="form-control" type="file" id="import-file" name="file">
<input class="form-control" type="file" id="import-file" name="file" accept="<?php echo $acceptedType; ?>">
</div>
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion apps/qubit/modules/object/templates/validateCsvSuccess.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
<div class="accordion-body">
<div class="mb-3">
<label for="file-input" class="form-label"><?php echo __('Select a CSV file to validate'); ?></label>
<input class="form-control" type="file" id="file-input" name="file">
<input class="form-control" type="file" id="file-input" name="file" accept=".csv">
</div>
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion plugins/sfSkosPlugin/modules/sfSkosPlugin/actions/importAction.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ protected function addField($name)
{
switch ($name) {
case 'file':
$this->form->setWidget('file', new sfWidgetFormInputFile());
$this->form->setWidget('file', new sfWidgetFormInputFile([], ['accept' => '.skos,.rdf,.xml,.ttl']));
$this->form->setValidator('file', new sfValidatorFile());

break;
Expand Down
Loading