Manual:$wgMimeTypeBlacklist

From MediaWiki.org
Jump to: navigation, search

Other languages:
Deutsch • ‎English • ‎español • ‎français • ‎italiano • ‎日本語 • ‎polski • ‎português
MIME types: $wgMimeTypeBlacklist
MIME types to disallow if $wgVerifyMimeType is enabled.
Introduced in version: 1.5.0
Removed in version: still in use
Allowed values: array of MIME types (strings)
Default value: (see below)

Other settings: Alphabetical | By Function

Details[edit | edit source]

Files with these MIME types will never be allowed as uploads if $wgVerifyMimeType is enabled.

Default value[edit | edit source]

MediaWiki version: 1.18

Default value since 1.18:

$wgMimeTypeBlacklist = array(
        # HTML may contain cookie-stealing JavaScript and web bugs
        'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript',
        # PHP scripts may execute arbitrary code on the server
        'application/x-php', 'text/x-php',
        # Other types that may be interpreted by some servers
        'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh',
        # Client-side hazards on Internet Explorer
        'text/scriptlet', 'application/x-msdownload',
        # Windows metafile, client-side vulnerability on some systems
        'application/x-msmetafile',
);
  • 'application/x-opc+zip', 'application/msword', 'application/vnd.ms-powerpoint', 'application/vnd.msexcel' were blacklisted after 1.17.0 (r81376), and removed in r82783
  • 'application/x-opc+zip', 'text/scriptlet', 'application/x-msdownload' were introduced after 1.5.5
  • 'application/x-msmetafile' was added in 1.5.5
  • 'application/zip' was added in 1.14 and then removed in 1.18
  • All other values were available since the setting was introduced in 1.5.0