I am trying to create a file validator for .csv uploads. This is my code that works at allowing csv uploads (which are disallowed by default):

$validators['file_validate_extensions'] = array('csv');
$file = file_save_upload('csv', $validators);

However, when I try to upload another file (in this case fizzbuzz.py) I get this error:

For security reasons, your upload has been renamed to fizzbuzz.py.txt.

How can I change this to being and out right error when a non csv file is uploaded?

EDIT: Did some more testing. This only occurs for my .py file. Files with a .png extension get rejected and are not uploaded.

EDITx2: Okay, so it also rejects .bat, .gnumeric, and .txt file extensions. It looks like Drupal does not validate two letter file extensions in the same way it validates three(+) letter file extensions.

1 Answer 1


If you take a look at the file_save_upload() call, you'll see what's happening with the py files. It seems to be a It will occur with php|pl|py|cgi|asp|js files.

FROM: file_save_upload() http://api.drupal.org/api/drupal/includes!file.inc/function/file_save_upload/7

// Rename potentially executable files, to help prevent exploits (i.e. will
// rename filename.php.foo and filename.php to filename.php.foo.txt and
// filename.php.txt, respectively). Don't rename if 'allow_insecure_uploads'
// evaluates to TRUE.
if (!variable_get('allow_insecure_uploads', 0) && preg_match('/\.(php|pl|py|cgi|asp|js) (\.|$)/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
$file->filemime = 'text/plain';
$file->uri .= '.txt';
$file->filename .= '.txt';
// The .txt extension may not be in the allowed list of extensions. We have
// to add it here or else the file upload will fail.
if (!empty($extensions)) {
  $validators['file_validate_extensions'][0] .= ' txt';
  drupal_set_message(t('For security reasons, your upload has been renamed to %filename.', array('%filename' => $file->filename)));


If you wish to allow these uploads (without converting their extensions), you would set all_insecure_uploads to 1 (TRUE), but I doubt you do :)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.