Validating extensions in file uploads

Question

I am trying to create a file validator for .csv uploads. This is my code that works at allowing csv uploads (which are disallowed by default):

$validators['file_validate_extensions'] = array('csv');
$file = file_save_upload('csv', $validators);

However, when I try to upload another file (in this case fizzbuzz.py) I get this error:

For security reasons, your upload has been renamed to fizzbuzz.py.txt.

How can I change this to being and out right error when a non csv file is uploaded?

EDIT: Did some more testing. This only occurs for my .py file. Files with a .png extension get rejected and are not uploaded.

EDITx2: Okay, so it also rejects .bat, .gnumeric, and .txt file extensions. It looks like Drupal does not validate two letter file extensions in the same way it validates three(+) letter file extensions.

Answer 1

If you take a look at the file_save_upload() call, you'll see what's happening with the py files. It seems to be a It will occur with php|pl|py|cgi|asp|js files.

FROM: file_save_upload() http://api.drupal.org/api/drupal/includes!file.inc/function/file_save_upload/7

// Rename potentially executable files, to help prevent exploits (i.e. will
// rename filename.php.foo and filename.php to filename.php.foo.txt and
// filename.php.txt, respectively). Don't rename if 'allow_insecure_uploads'
// evaluates to TRUE.
if (!variable_get('allow_insecure_uploads', 0) && preg_match('/\.(php|pl|py|cgi|asp|js) (\.|$)/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
$file->filemime = 'text/plain';
$file->uri .= '.txt';
$file->filename .= '.txt';
// The .txt extension may not be in the allowed list of extensions. We have
// to add it here or else the file upload will fail.
if (!empty($extensions)) {
  $validators['file_validate_extensions'][0] .= ' txt';
  drupal_set_message(t('For security reasons, your upload has been renamed to %filename.', array('%filename' => $file->filename)));
}

}

If you wish to allow these uploads (without converting their extensions), you would set all_insecure_uploads to 1 (TRUE), but I doubt you do :)

KMT