I have two member groups, Editors & SuperAdmins

When logged in as an Editor, I get the following error when trying to upload any .mp3 via ‘Publish’:

The file you are attempting to upload has invalid content for its MIME type.

However, I can upload the exact same file into the exact same upload directory as a SuperAdmin, no problems.

I’m positive that the Editors group has upload privileges for the directory in question. I’m also positive that it is a valid MP3 and that “.mp3” is listed in my mimes.php file. (I assume it was there by default.)

Am I missing something?

Probably XSS filtering at work here.  Can you go to:  CP Home ›  Admin ›  System Preferences ›  Security and Session Preferences and see what your setting for “Apply XSS Filtering to uploaded files? ” is

Thanks,

-greg

That did it.

So I’m assuming the XSS filter is looking for any signs of code injection? and/or maybe re-encoding the file? Whatever the case, why would a non-Admin user group make a difference? Does EE make exceptions if the file is coming from an Admin?

Anyways, Thanks for your insight.

Ryan

XSS-filtering is skipped for Super-Admins by default, yes.

Right- by default, superadmins are exempt from the check.  It’s basically looking for signs of an injection attack via the image.  Unless you are dead certain that only trusted personnel can upload images- and that include things like signature images and avatars- it’s best to leave it on.  If someone has an image that fails, they can always email it and admins can make the call on whether to upload it.

Robin Sowell - 23 October 2008 09:45 AM

Right- by default, superadmins are exempt from the check.  It’s basically looking for signs of an injection attack via the image.  Unless you are dead certain that only trusted personnel can upload images- and that include things like signature images and avatars- it’s best to leave it on.  If someone has an image that fails, they can always email it and admins can make the call on whether to upload it.

OK if we leave it on, how do we allow another user to upload an mp3 file that normal errors out because of this?

Any way no skip XSS, for certain member groups, while leaving it on for others,  I’d like to keep the site as secure as possible, But I do need to have a few users be able to upload mp3 files.

jhgravelle,

Super Admins are the only member group who have an exception to XSS filtering.
You could maybe create a new member group based on the SuperAdmin group and lock down as much as you need then assign those few users to it.