{"record":{"id":"923efd83d52f8c7b","repo":"OrchardCMS/OrchardCore","slug":"this-file-extension-is-not-allowed-0","errorCode":null,"errorMessage":"This file extension is not allowed: {0}","messagePattern":"This file extension is not allowed: (.+?)","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs","lineNumber":191,"sourceCode":"        var fileName = pathSegments[^1];\n        var directoryName = string.Join('/', pathSegments[..^1]);\n        var filePath = _mediaFileStore.Combine(directoryName, fileName);\n\n        if (!await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia)\n            || !await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, (object)(directoryName ?? string.Empty)))\n        {\n            throw new InvalidOperationException(S[\"Not authorized to upload media.\"].Value);\n        }\n\n        var extension = Path.GetExtension(filePath);\n        var canUploadRestrictedMedia = await _authorizationService.AuthorizeAsync(\n            user,\n            MediaPermissions.UploadRestrictedMedia);\n        if (!_mediaOptions.AllowedFileExtensions.Contains(extension)\n            && (!canUploadRestrictedMedia\n                || !_mediaOptions.RestrictedFileExtensions.Contains(extension)))\n        {\n            throw new InvalidOperationException(S[\"This file extension is not allowed: {0}\", extension].Value);\n        }\n\n        Stream stream = null;\n        try\n        {\n            stream = new MemoryStream(bits);\n            filePath = await _mediaFileStore.CreateFileFromStreamAsync(\n                _fileCreationService,\n                filePath,\n                stream,\n                contentType: file.Optional<string>(\"type\"));\n        }\n        finally\n        {\n            stream?.Dispose();\n        }\n\n        var publicUrl = _mediaFileStore.MapPathToPublicUrl(filePath);","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs#L173-L209","documentation":"The uploaded file's extension is checked against MediaOptions.AllowedFileExtensions; if not allowed, the extension must be present in RestrictedFileExtensions AND the user must hold UploadRestrictedMedia permission. Otherwise it throws 'This file extension is not allowed: {0}'.","triggerScenarios":"Uploading a file whose extension (case as derived from the path) is not in the allowed list and is not an allowed restricted upload by a permitted user; e.g. .exe, .svg when not configured.","commonSituations":"Strict default media settings blocking formats like .svg or .webp; clients uploading file types not added in Media settings; case/leading-dot variations in extension.","solutions":["Add the extension to Settings > Media > Allowed file extensions","Or add it to Restricted file extensions and grant the role 'Upload restricted media' permission","Rename the file to an allowed extension if the content type genuinely differs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var ext = Path.GetExtension(media.name); var allowed = mediaOptions.AllowedFileExtensions.Contains(ext) || (mediaOptions.RestrictedFileExtensions.Contains(ext) && canUploadRestricted);","typeGuard":null,"tryCatchPattern":"try { await client.NewMediaObjectAsync(blogId, user, pass, media); } catch (InvalidOperationException ex) when (ex.Message.StartsWith(\"This file extension is not allowed\")) { ConvertFileToAllowedExtension(media); }","preventionTips":["Check the site's allowed/restricted extension lists before configuring clients","Add needed extensions in Media settings","Grant UploadRestrictedMedia where restricted types (e.g. svg) are legitimately required","Rename files to appropriate extensions rather than forcing disallowed types"],"tags":["xmlrpc","media","file-extension","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}