Authorized user gets an error each time when uploading a PDF with more than one dot in the name (other than the PDF extension, i.e this.is.an.example.10.pdf) but there are no disallowed extensions in the file name.

The error says "For security reasons, your upload has been renamed to..." (surprisingly the renamed file is the SAME as the original upload name!) Since there are no exe php etc in the filename, why is this PDF being flagged? I searched for some time to no avail. Thanks!

  • 4
    This question appears to be off-topic because it is a bugreport for file upload security algorithm, and should be reported in Durpal core issue queue, not here.
    – Mołot
    Feb 28, 2014 at 7:59
  • Okay @Mołot I will move it to the core issue queue. Feb 28, 2014 at 14:48

1 Answer 1


when the upload file name contains multiple (.) in file name, after each dot it will be considered as extension of the file. In your case(this.is.an.example.10.pdf) it will check (is,an,examplem,10) in valid extension, It is not match with that it will add (_)inthat. If your uploaded file name is not same after drupal changes it will give that error. For more detail check file_munge_filename

Not the answer you're looking for? Browse other questions tagged or ask your own question.