{"record":{"id":"3c0038d18e146287","repo":"octobercms/october","slug":"backend-lang-media-type-blocked-3c0038","errorCode":null,"errorMessage":"backend::lang.media.type_blocked","messagePattern":"backend::lang\\.media\\.type_blocked","errorType":"exception","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"modules/media/widgets/MediaManager.php","lineNumber":426,"sourceCode":"\n        $newName = trim(Input::get('name'));\n        if (!strlen($newName)) {\n            throw new ApplicationException(Lang::get('cms::lang.asset.name_cant_be_empty'));\n        }\n\n        if (!$this->validateFileName($newName)) {\n            throw new ApplicationException(Lang::get('cms::lang.asset.invalid_name'));\n        }\n\n        $originalPath = Input::get('originalPath');\n        $originalPath = MediaLibrary::validatePath($originalPath);\n        $newPath = dirname($originalPath).'/'.$newName;\n        $type = Input::get('type');\n\n        if ($type === MediaLibraryItem::TYPE_FILE) {\n            // Validate extension\n            if (!$this->validateFileType($newName)) {\n                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));\n            }\n\n            if (Config::get('media.clean_vectors', true) && $this->isVector($newName)) {\n                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));\n            }\n\n            // Move single file\n            MediaLibrary::instance()->moveFile($originalPath, $newPath);\n\n            /**\n             * @event media.file.rename\n             * Called after a file is renamed / moved\n             *\n             * Example usage:\n             *\n             *     Event::listen('media.file.rename', function ((\\Media\\Widgets\\MediaManager) $mediaWidget, (string) $originalPath, (string) $newPath) {\n             *         \\Log::info($originalPath . \" was moved to \" . $path);\n             *     });","sourceCodeStart":408,"sourceCodeEnd":444,"githubUrl":"https://github.com/octobercms/october/blob/b608633a7e8922487d91a8161499020121c3b3bf/modules/media/widgets/MediaManager.php#L408-L444","documentation":"When onApplyName renames a file, validateFileType($newName) re-applies the default_extensions allow-list (plus the safe-mode less/sass/scss block) — renaming to an extension outside that list throws backend::lang.media.type_blocked. A sibling guard a few lines below reuses the same message to block renaming anything identified as SVG (extension 'svg') while the media.clean_vectors config is true (the default): renames would bypass the upload-time SVG sanitization (\\Html::cleanVector), so vector renames are refused instead.","triggerScenarios":"Renaming photo.png to photo.php, file.heic, or any non-whitelisted extension; renaming banner.svg to banner2.svg while media.clean_vectors is true (default); renaming to .less/.scss with safe mode on.","commonSituations":"Users trying to change an extension via rename to make a file 'run' or open; developers surprised that SVG renames fail even though SVG uploads succeed (uploads are sanitized, renames are not); expectations mismatched with the clean_vectors default.","solutions":["Rename keeping an allowed extension — check FileDefinitions::get('default_extensions') for the live list","For legitimate SVG renames, set ['media']['clean_vectors'] => false in config/media.php (accept the trade-off that renamed vectors skip sanitization)","For new formats, extend default_extensions rather than renaming to unlisted extensions","If you need an executable or arbitrary file managed, use the CMS/file attachments, not the public media folder"],"exampleFix":"// config/media.php — before (default behavior blocks SVG renames)\nreturn [];\n\n// after — permit SVG renames when you accept the trade-off\nreturn [\n    'clean_vectors' => false,\n];","handlingStrategy":"validation","validationCode":"$ext = strtolower(pathinfo($newName, PATHINFO_EXTENSION));\n$allowed = FileDefinitions::get('default_extensions');\n$isVector = $ext === 'svg';\nif (!in_array($ext, $allowed, true)\n    || (Config::get('media.clean_vectors', true) && $isVector)) {\n    return Response::json(['error' => 'Extension not permitted for rename: '.$ext], 422);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Rename files without changing to an unlisted extension; convert formats offline instead","Decide your clean_vectors policy consciously — true (default) blocks all SVG renames","Re-check the allow-list whenever FileDefinitions are customized, since renames and uploads share it"],"tags":["media","rename","file-extension","svg","allow-list","security"],"backgroundTag":"file-extension-not-allowed","analyzedSha":"b608633a7e8922487d91a8161499020121c3b3bf","analyzedAt":"2026-08-21T04:24:57.515Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}