I'm surprised this hasn't been asked before like this.

I want to allow users to upload files of all file extensions, without enabling each extension by hand. How do I do it?

4 Answers 4


You can use Allow all file extension Module

This module reverts Drupal 7's file upload widget to the Drupal 6 behavior, and trusts the site administrator to be smart enough to allow uploads with any file extension. It also lengthens the allowed file extensions box from 128 characters to 2048, allowing you to specify a larger number of extensions.

While I realize this is somewhat insecure and would have liked to add more functionality to this module, this isn't something I should have needed to do at all, and I don't have a whole lot of time to spend on it. If there are any bugs, I'll try to fix them, but beyond that, I won't be adding new features to it. If you would like add new features to this module, I would gladly accept a co-maintainer (or even transfer ownership to someone else).

Warning: The ability to leave the allowed file extensions box blank was removed for a reason. If you leave it blank and allow random users to upload files of any type, you'll have an insecure site. As such, you are strongly cautioned only to allow trusted users to do this.

  • Do you know why it's insecure to upload files of any type?
    – Turion
    Commented Jan 4, 2015 at 6:59
  • 2
    @Turion It isn't, inherently, it depends on how well your server and app are configured. For example, if your server security is lax, and someone can upload a .php file with this in it: shell_exec("rm -rf ".$_SERVER['DOCUMENT_ROOT']);, you could be in trouble. Short answer: don't use this module unless you know exactly what you're doing, and have control over, and can reliably secure, your server
    – Clive
    Commented Jan 4, 2015 at 11:58
  • 1
    In addition, some uploaded files, like executables, might not compromise your server but will potentially compromise your users' machines when they download it. This will cause your website, even if not compromised itself, to be flagged as distributing malware. As such, it might be removed from SERPs, and also added to browser's warning lists. Be very careful.
    – Mario Awad
    Commented Jan 6, 2015 at 19:13

You can override the required = true in file_field_instance_settings_form function that returns and form array and then remove the extensions from your ui config so that drupal use with out the validate function that also checks the resource suffixes.

Same for Drupal 8.


use Drupal\Core\Form\FormStateInterface;

/** * Implements hook_form_form_id_alter(). */ function my_module_file_upload_config_form_field_config_edit_form_alter(&$form, FormStateInterface $form_state, $form_id) { if($form['settings']['file_extensions']['#required']) { $form['settings']['file_extensions']['#required'] = FALSE; } }


For Drupal >= 8. ( I mean Drupal 8, Drupal 9 )

use Allow All File Extensions for file fields module

it lets you make the "Allow extensions" field be empty. it means you can upload any file type.


you just need to define any file extension that user need to upload it in file field that attached to content type example: add new file field to any content type and in field setting add the approved extension enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.