mahara-contributors team mailing list archive

[Aaron Wells <1249858@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

There have been several notable Mahara bugs based around the fact that
our current handling of mimetypes is broken.

See for instance:
 - https://bugs.launchpad.net/mahara/+bug/1220639
 - https://bugs.launchpad.net/mahara/+bug/1249166

The problem is this:

1. You can't really trust the mimetype that the browser sends to you, because different browsers send different wacky things
2. Mahara has long used its own function file_mime_type() in lib/file.php for this purpose
3. file_mime_type() preferentially uses finfo() to check the mimetype. But, there's a bug in finfo() with an external magic db, which is how it is distributed on Ubuntu presently: https://bugs.php.net/bug.php?id=61940
4. file_mime_type() falls back to mime_content_type(). But that's now deprecated
5. If neither of those works, we fall back to trusting what the browser told us, which isn't really the best (see #1)

** Affects: mahara
     Importance: Medium
     Assignee: Robert Lyon (robertl-9)
         Status: Confirmed


** Tags: fileupload mimetype

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1249858

Title:
  Mahara can't figure out mime types because of a finfo() bug

Status in Mahara ePortfolio:
  Confirmed

Bug description:
  There have been several notable Mahara bugs based around the fact that
  our current handling of mimetypes is broken.

  See for instance:
   - https://bugs.launchpad.net/mahara/+bug/1220639
   - https://bugs.launchpad.net/mahara/+bug/1249166

  The problem is this:

  1. You can't really trust the mimetype that the browser sends to you, because different browsers send different wacky things
  2. Mahara has long used its own function file_mime_type() in lib/file.php for this purpose
  3. file_mime_type() preferentially uses finfo() to check the mimetype. But, there's a bug in finfo() with an external magic db, which is how it is distributed on Ubuntu presently: https://bugs.php.net/bug.php?id=61940
  4. file_mime_type() falls back to mime_content_type(). But that's now deprecated
  5. If neither of those works, we fall back to trusting what the browser told us, which isn't really the best (see #1)

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1249858/+subscriptions