Introduce mime type whitelist

2 files changed, 18 insertions, 2 deletions

diff --git a/php/includes/settings.inc.php b/php/includes/settings.inc.php
index 01a0f86..f8c78cb 100644
--- a/php/includes/settings.inc.php
+++ b/php/includes/settings.inc.php
@@ -81,14 +81,26 @@ define('POMF_FILES_LENGTH', 6);
  */
 define('POMF_URL', 'https://i.pantsu.cat/');
 
-
-/* *
+/**
  * Blocked mime types
  * @param string[] $FILTER_MIME blocked mime types
  */
 $FILTER_MIME = array("")
 
 /**
+ * Whitelisted mime types
+ * @param bool $WHIELIST to enable whitelist of mime types 
+ */
+
+define('WHITELSIST', false);
+
+/**
+ * Whitelisted mime types
+ * @param string[] $WHITELIST_MIME_MIME allowed mime types
+ */
+$WHITELIST_MIME = array("")
+
+/**
  * Double dot file extensions
  *
  * Pomf keeps the last file extension for the uploaded file. In other words, an
diff --git a/php/upload.php b/php/upload.php
index a189f87..7ea89ff 100644
--- a/php/upload.php
+++ b/php/upload.php
@@ -84,6 +84,10 @@ function uploadFile($file)
     if (!in_array(mime_content_type($file), $FILTER_MIME)) {
         throw new UploadException(UPLOAD_ERR_EXTENSION);
     }
+    if $WHITELIST == true {
+        if (!in_array(mime_content_type($file), $WHITELIST_MIME)) {
+            throw new UploadException(UPLOAD_ERR_EXTENSION);
+    }
 
 
     // Check if a file with the same hash and size (a file which is the same)