octobercms/october · error · ApplicationException

The file type used is blocked for security reasons.

Error message

The file type used is blocked for security reasons.

What it means

ApplicationException at MediaManager.php:1607 thrown when validateFileType($fileName) rejects the upload's extension. The media manager enforces an extension policy (a default blocklist of dangerous extensions plus optional configuration) before accepting any file; Lang::get('backend::lang.media.type_blocked') renders the message 'The file type used is blocked for security reasons.'

Source

Thrown at modules/media/widgets/MediaManager.php:1607

             *
             */
            $this->fireSystemEvent('media.file.beforeUpload', [$uploadedFile]);

            // Convert uppercase file extensions to lowercase
            $fileName = $uploadedFile->getClientOriginalName();
            $extension = strtolower($uploadedFile->getClientOriginalExtension());
            $fileName = File::name($fileName).'.'.$extension;

            // File name is invalid or auto rename is enabled, slug the value
            $autoRename = Config::get('media.auto_rename') === 'slug';
            if ($autoRename || !$this->validateFileName($fileName)) {
                $fileNameClean = $this->slugFileName(File::name($fileName));
                $fileName = "{$fileNameClean}.{$extension}";
            }

            // Check for unsafe file extensions
            if (!$this->validateFileType($fileName)) {
                throw new ApplicationException(Lang::get('backend::lang.media.type_blocked'));
            }

            // See mime type handling in the asset manager
            if (!$uploadedFile->isValid()) {
                throw new ApplicationException($uploadedFile->getErrorMessage());
            }

            $path = $quickMode ? '/uploaded-files' : Input::get('path');
            $path = MediaLibrary::validatePath($path);
            $filePath = $path.'/'.$fileName;

            // getRealPath() can be empty for some environments (IIS)
            $realPath = empty(trim($uploadedFile->getRealPath()))
                ? $uploadedFile->getPath() . DIRECTORY_SEPARATOR . $uploadedFile->getFileName()
                : $uploadedFile->getRealPath();

            // Check and clean vector files
            // @todo use streaming like file objects

View on GitHub (pinned to b608633a7e)

Solutions

  1. Upload a permitted format, or re-encode the asset (e.g. convert SVG to PNG) if it is on the blocklist.
  2. Adjust the extension policy deliberately: review config/media.php (blocked/allowed extensions) and remove/add entries with full awareness that unblocking executable extensions is dangerous.
  3. If the file is legitimate, keep the block and deliver such assets through a properly sandboxed static host instead of the media manager.
Defensive patterns

Strategy: validation

Validate before calling

// Client-side extension pre-check mirroring the server policy
const BLOCKED = ['php','phtml','html','htm','svg']; // keep in sync with config
const ext = file.name.split('.').pop().toLowerCase();
if (BLOCKED.includes(ext)) {
    alert(`Files of type .${ext} are not allowed.`);
    return;
}
$.request('onUpload', { data: fd });

Type guard

function isAllowedExtension(name, allowed) {
    const ext = name.split('.').pop().toLowerCase();
    return allowed.length === 0 ? true : allowed.includes(ext);
}

Try / catch

try {
    $widget->onUpload();
} catch (\October\Rain\Exception\ApplicationException $e) {
    if (strpos($e->getMessage(), 'blocked') !== false) {
        // surface the policy message to the user, do not retry
        return Response::json(['error' => $e->getMessage()], 422);
    }
    throw $e;
}

Prevention

When it happens

Trigger: Uploading a file whose extension is on the blocked list (e.g. .php, .phtml, .html, .htm, .svg — anything the active media config blocks) or, when an allowlist is configured, any extension not on it. The check runs on the server-side filename after optional slug renaming, so renaming alone does not bypass it.

Common situations: Trying to upload SVG icons or HTML assets that are blocked by default; projects that set media config (e.g. allowed/blocked extension lists in config/media.php) and forget to include a format a client needs; double extensions like image.php.jpg where the final resolved extension hits the blocklist.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/527e83bbb3b7c7f1. Report an issue: GitHub.