diff --git a/src/controllers/uploads.js b/src/controllers/uploads.js index 511cfe2f8e..fec5607fe4 100644 --- a/src/controllers/uploads.js +++ b/src/controllers/uploads.js @@ -125,6 +125,14 @@ function uploadFile(uid, uploadedFile, callback) { return callback(new Error('[[error:file-too-big, ' + meta.config.maximumFileSize + ']]')); } + if (meta.config.hasOwnProperty('allowedFileExtensions')) { + var allowed = meta.config.allowedFileExtensions.split(',').filter(Boolean); + var extension = path.extname(uploadedFile.name).slice(1); + if (allowed.length > 0 && allowed.indexOf(extension) === -1) { + return callback(new Error('[[error:invalid-file-type, ' + allowed.join(', ') + ']]')); + } + } + var filename = uploadedFile.name || 'upload'; filename = Date.now() + '-' + validator.escape(filename).substr(0, 255); diff --git a/src/views/admin/settings/post.tpl b/src/views/admin/settings/post.tpl index 96ceb01ff6..dbb13f2714 100644 --- a/src/views/admin/settings/post.tpl +++ b/src/views/admin/settings/post.tpl @@ -132,13 +132,18 @@ Allow users to upload regular files +
+ Enter comma-separated list of file extensions here (e.g. pdf,xls,doc
).
+ An empty list means all extensions are allowed.
+