octobercms/october · error · ApplicationException

backend::lang.media.type_blocked

Error message

backend::lang.media.type_blocked

What it means

When onApplyName renames a file, validateFileType($newName) re-applies the default_extensions allow-list (plus the safe-mode less/sass/scss block) — renaming to an extension outside that list throws backend::lang.media.type_blocked. A sibling guard a few lines below reuses the same message to block renaming anything identified as SVG (extension 'svg') while the media.clean_vectors config is true (the default): renames would bypass the upload-time SVG sanitization (\Html::cleanVector), so vector renames are refused instead.

Source

Thrown at modules/media/widgets/MediaManager.php:426

        $newName = trim(Input::get('name'));
        if (!strlen($newName)) {
            throw new ApplicationException(Lang::get('cms::lang.asset.name_cant_be_empty'));
        }

        if (!$this->validateFileName($newName)) {
            throw new ApplicationException(Lang::get('cms::lang.asset.invalid_name'));
        }

        $originalPath = Input::get('originalPath');
        $originalPath = MediaLibrary::validatePath($originalPath);
        $newPath = dirname($originalPath).'/'.$newName;
        $type = Input::get('type');

        if ($type === MediaLibraryItem::TYPE_FILE) {
            // Validate extension
            if (!$this->validateFileType($newName)) {
                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));
            }

            if (Config::get('media.clean_vectors', true) && $this->isVector($newName)) {
                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));
            }

            // Move single file
            MediaLibrary::instance()->moveFile($originalPath, $newPath);

            /**
             * @event media.file.rename
             * Called after a file is renamed / moved
             *
             * Example usage:
             *
             *     Event::listen('media.file.rename', function ((\Media\Widgets\MediaManager) $mediaWidget, (string) $originalPath, (string) $newPath) {
             *         \Log::info($originalPath . " was moved to " . $path);
             *     });

View on GitHub (pinned to b608633a7e)

Solutions

  1. Rename keeping an allowed extension — check FileDefinitions::get('default_extensions') for the live list
  2. For legitimate SVG renames, set ['media']['clean_vectors'] => false in config/media.php (accept the trade-off that renamed vectors skip sanitization)
  3. For new formats, extend default_extensions rather than renaming to unlisted extensions
  4. If you need an executable or arbitrary file managed, use the CMS/file attachments, not the public media folder

Example fix

// config/media.php — before (default behavior blocks SVG renames)
return [];

// after — permit SVG renames when you accept the trade-off
return [
    'clean_vectors' => false,
];
Defensive patterns

Strategy: validation

Validate before calling

$ext = strtolower(pathinfo($newName, PATHINFO_EXTENSION));
$allowed = FileDefinitions::get('default_extensions');
$isVector = $ext === 'svg';
if (!in_array($ext, $allowed, true)
    || (Config::get('media.clean_vectors', true) && $isVector)) {
    return Response::json(['error' => 'Extension not permitted for rename: '.$ext], 422);
}

Prevention

When it happens

Trigger: Renaming photo.png to photo.php, file.heic, or any non-whitelisted extension; renaming banner.svg to banner2.svg while media.clean_vectors is true (default); renaming to .less/.scss with safe mode on.

Common situations: Users trying to change an extension via rename to make a file 'run' or open; developers surprised that SVG renames fail even though SVG uploads succeed (uploads are sanitized, renames are not); expectations mismatched with the clean_vectors default.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/3c0038d18e146287. Report an issue: GitHub.