What is to stop somebody uploading a file that does not contain what is says it contains.

 

It seems that you can only specify file type by extension (for example jpg) but what is to stop somebody uploading sdfsdf.txt.jpg which is just a renamed text file.

 

Is there any way to check content type of the file before upload?

 

JG

JG

 

AjaxUploader do not provide content-type for security version.

 

The content-type is send by client side and that is not trust-able.

 

Developer should check the extension and data to prevent the code be executed at server side.

 

Regards,
Terry