{"record":{"id":"527e83bbb3b7c7f1","repo":"octobercms/october","slug":"the-file-type-used-is-blocked-for-security-reasons","errorCode":null,"errorMessage":"The file type used is blocked for security reasons.","messagePattern":"The file type used is blocked for security reasons\\.","errorType":"validation","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"modules/media/widgets/MediaManager.php","lineNumber":1607,"sourceCode":"             *\n             */\n            $this->fireSystemEvent('media.file.beforeUpload', [$uploadedFile]);\n\n            // Convert uppercase file extensions to lowercase\n            $fileName = $uploadedFile->getClientOriginalName();\n            $extension = strtolower($uploadedFile->getClientOriginalExtension());\n            $fileName = File::name($fileName).'.'.$extension;\n\n            // File name is invalid or auto rename is enabled, slug the value\n            $autoRename = Config::get('media.auto_rename') === 'slug';\n            if ($autoRename || !$this->validateFileName($fileName)) {\n                $fileNameClean = $this->slugFileName(File::name($fileName));\n                $fileName = \"{$fileNameClean}.{$extension}\";\n            }\n\n            // Check for unsafe file extensions\n            if (!$this->validateFileType($fileName)) {\n                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));\n            }\n\n            // See mime type handling in the asset manager\n            if (!$uploadedFile->isValid()) {\n                throw new ApplicationException($uploadedFile->getErrorMessage());\n            }\n\n            $path = $quickMode ? '/uploaded-files' : Input::get('path');\n            $path = MediaLibrary::validatePath($path);\n            $filePath = $path.'/'.$fileName;\n\n            // getRealPath() can be empty for some environments (IIS)\n            $realPath = empty(trim($uploadedFile->getRealPath()))\n                ? $uploadedFile->getPath() . DIRECTORY_SEPARATOR . $uploadedFile->getFileName()\n                : $uploadedFile->getRealPath();\n\n            // Check and clean vector files\n            // @todo use streaming like file objects","sourceCodeStart":1589,"sourceCodeEnd":1625,"githubUrl":"https://github.com/octobercms/october/blob/b608633a7e8922487d91a8161499020121c3b3bf/modules/media/widgets/MediaManager.php#L1589-L1625","documentation":"ApplicationException at MediaManager.php:1607 thrown when validateFileType($fileName) rejects the upload's extension. The media manager enforces an extension policy (a default blocklist of dangerous extensions plus optional configuration) before accepting any file; Lang::get('backend::lang.media.type_blocked') renders the message 'The file type used is blocked for security reasons.'","triggerScenarios":"Uploading a file whose extension is on the blocked list (e.g. .php, .phtml, .html, .htm, .svg — anything the active media config blocks) or, when an allowlist is configured, any extension not on it. The check runs on the server-side filename after optional slug renaming, so renaming alone does not bypass it.","commonSituations":"Trying to upload SVG icons or HTML assets that are blocked by default; projects that set media config (e.g. allowed/blocked extension lists in config/media.php) and forget to include a format a client needs; double extensions like image.php.jpg where the final resolved extension hits the blocklist.","solutions":["Upload a permitted format, or re-encode the asset (e.g. convert SVG to PNG) if it is on the blocklist.","Adjust the extension policy deliberately: review config/media.php (blocked/allowed extensions) and remove/add entries with full awareness that unblocking executable extensions is dangerous.","If the file is legitimate, keep the block and deliver such assets through a properly sandboxed static host instead of the media manager."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client-side extension pre-check mirroring the server policy\nconst BLOCKED = ['php','phtml','html','htm','svg']; // keep in sync with config\nconst ext = file.name.split('.').pop().toLowerCase();\nif (BLOCKED.includes(ext)) {\n    alert(`Files of type .${ext} are not allowed.`);\n    return;\n}\n$.request('onUpload', { data: fd });","typeGuard":"function isAllowedExtension(name, allowed) {\n    const ext = name.split('.').pop().toLowerCase();\n    return allowed.length === 0 ? true : allowed.includes(ext);\n}","tryCatchPattern":"try {\n    $widget->onUpload();\n} catch (\\October\\Rain\\Exception\\ApplicationException $e) {\n    if (strpos($e->getMessage(), 'blocked') !== false) {\n        // surface the policy message to the user, do not retry\n        return Response::json(['error' => $e->getMessage()], 422);\n    }\n    throw $e;\n}","preventionTips":["Publish and review the media extension config in every environment.","Keep client and server blocklists in sync to fail fast.","Never unblock executable extensions to work around this; re-encode the asset instead."],"tags":["media-manager","upload","file-type","security","blocked-extension"],"backgroundTag":"file-type-blocked","analyzedSha":"b608633a7e8922487d91a8161499020121c3b3bf","analyzedAt":"2026-08-21T04:24:57.515Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}