diff --git a/js/import.js b/js/import.js index 0a5fb4c0f457..1c555a37a36d 100644 --- a/js/import.js +++ b/js/import.js @@ -30,6 +30,15 @@ function matchFile (fname) { var len = fnameArray.length; if (len !== 0) { var extension = fnameArray[len - 1]; + // list of valid extension + var validExt = ['csv','sql','xml','txt','ods','atx','ain','aih','dbf','gz','zip','bz2']; + if (!validExt.includes(extension)) { + // alert error response + alert( + 'Invalid file format . Valid file format (\'csv\',\'sql\',\'xml\',\'txt\',\'ods\',\'atx\',\'ain\',\'aih\',\'dbf\',\'gz\',\'zip\',\'bz2\')\n'); + // clear the input field to force user to upload again + $('#input_import_file').val(''); + } if (extension === 'gz' || extension === 'bz2' || extension === 'zip') { len--; } diff --git a/libraries/entry_points/import.php b/libraries/entry_points/import.php index 9f15d01d6e76..6b4066af3426 100644 --- a/libraries/entry_points/import.php +++ b/libraries/entry_points/import.php @@ -459,6 +459,29 @@ // handle filenames if (isset($_FILES['import_file'])) { + $fileName = $_FILES['import_file']["name"]; + $explodeByDot = explode(".",$fileName); + $sizeOfExplodedArray= sizeof($explodeByDot); + if($sizeOfExplodedArray < 2){ + $message = PhpMyAdmin\Message::error( + __( + 'Invalid file .' + ) + ); + $import->stop($message); + } else { + $extension =$explodeByDot[$sizeOfExplodedArray-1]; + $validExtension = array('csv','sql','xml','txt','ods','atx','ain','aih','dbf','gz','zip','bz2'); + if (!in_array($extension,$validExtension)) { + $message = PhpMyAdmin\Message::error( + __( + ('Invalid file format . Valid file format (\'csv\',\'sql\',\'xml\',\'txt\',\'ods\',\'atx\',\'ain\',\'aih\',\'dbf\',\'gz\',\'zip\',\'bz2\')') + ) + ); + $import->stop($message); + } + } + $import_file = $_FILES['import_file']['tmp_name']; $import_file_name = $_FILES['import_file']['name']; } @@ -487,7 +510,9 @@ /** * Handle file compression */ + $import_handle = new File($import_file); + $import_handle->checkUploadedFile(); if ($import_handle->isError()) { $import->stop($import_handle->getError());