Thread

Hello all,

I’m building a site for a non-profit, which needs to be able to upload assorted types of media (.pdfs, .mp3s, .jpgs, etc). I set up and tested the file upload destinations without any problem.

So today, as I was walking my client through a tutorial on her computer (as in, I was using her computer to show her the process), I ran into a MIME type error when trying to upload a legal file type, a .pdf.

She downloaded this file from their old website: http://www.tahomachoirs.org/Newsletter.pdf
When she tried to upload it, EE told her the MIME type was invalid. When I downloaded the same file from that website, and tried to upload it, I didn’t get any error. It uploaded just fine. When I log in as HER on my computer, I get the same error. In the File Upload destinations, I selected her Member Group to be able to upload into this directory, so I’m not sure why it’s restricting her MIME type access.

Any idea what the problem could be here? Any reason why a Super Admin could upload a certain MIME type (.pdf), but a Member couldn’t?

I’m using EE 1.6.9, Build:  20100430

Thanks!

[Mod Edit: Moved to the EE 1 Technical Support forum]

Files uploaded by members that are not Superadmins are scanned for security reasons. Some files, especially thos containing “active content” fail this test. Your best option here is to upload them as a Superadmin (or via FTP), or disable XSS checking.

Thanks, Ingmar. I disabled XSS checking as recommended, and that fixed that problem. (for anyone with the same problem, you can find that setting under Admin—> System Preferences—> Security and Session Preferences)

I found this bug ticket from someone who noticed a similar problem: https://support.ellislab.com/bugs/detail/11766/

Is this a legacy problem that was fixed in 2.0? I understand the need for security, definitely. However, if that causes .pdf uploads to fail for anyone other than a SuperAdmin, that seems like kind of a big problem. Most of the sites I’ve built have users needing to upload .pdf files, who aren’t part of the SuperAdmin group… and having to request a SuperAdmin to take care of a simple upload every time you need a .pdf added to the site? Hmmm.

I found this bug ticket from someone who noticed a similar problem: https://support.ellislab.com/bugs/detail/11766/

Is this a legacy problem that was fixed in 2.0?

No, it was working as intended and not considereda bug.

However, if that causes .pdf uploads to fail for anyone other than a SuperAdmin, that seems like kind of a big problem. Most of the sites I’ve built have users needing to upload .pdf files, who aren’t part of the SuperAdmin group…

It’s not that all .pdf files fail, far from it. It’s just that EE likes to err on the side of caution. If you don’t want that level of scrutiny, just disable it.