Bug #67516 [Fbk->Opn]: wrong mimetypes with finfo_file(filename, FILEINFO_MIME_TYPE)

Edit report at https://bugs.php.net/bug.php?id=67516&edit=1 ID: 67516 User updated by: spam2 at rhsoft dot net Reported by: spam2 at rhsoft dot net Summary: wrong mimetypes with finfo_file(filename, FILEINFO_MIME_TYPE) -Status: Feedback +Status: Open Type: Bug Package: Filesystem function related Operating System: Linux PHP Version: 7.0.11 Block user comment: N Private report: N New Comment: Fedora tickets - sorry, but there where over the years way too much not php related bugreports and searching for "file" which is the package name leads to nowhere anyways, there needs to be done something that PHP drifts that far form the rest of the world in file detection - if i allow application/octet-stream for image extensions i can skip the complete checks at all Previous Comments: ------------------------------------------------------------------------ [2016-09-08 23:03:30] ab@php.net @spam2 please link the RHEL tickets you've mentioned. Thanks. ------------------------------------------------------------------------ [2016-09-08 23:00:28] ab@php.net Related To: Bug #73046 ------------------------------------------------------------------------ [2016-09-08 11:20:16] cmb@php.net > i guess some format changed and hence to fork libmagic instead > intrudce a shim-layer for streaming-support and openbase-dir is > a historical mistake It appears to me that there had also limitations of libmagic to be solved. From a quick look at libmagic.patch[1], I see that the memory management was hard-coded to malloc() and frieds, that WIN32 might not have been supported at all, that an IS_STRING macro is defined by libmagic which might clash with Zend's IS_STRING, and that there also have been some bugs. I agree, though, that patching an external library is unfortunate, and the status of current libmagic should be reviewed. Perhaps there are cleaner solutions possible now. Patches are welcome! [1] <https://github.com/php/php-src/blob/master/ext/fileinfo/libmagic.patch> ------------------------------------------------------------------------ [2016-09-08 11:20:14] spam2 at rhsoft dot net BTW: > it shouldn't be necessary to compile > with a custom magic.mgc, because you > could pass a custom magic.mgc directly > as second parameter to finfo_open() besides the current issues on Fedora 24 (se above and the otehr bugreport as requested) this *really* deserves a "php.ini" parameter to make this system-wide *and* exclude the path from open-basedir checks because it's form the server configuration (like session_savedir don't need and must not be in the document root for security reasons as long it's not set in .htaccess or with ini_set) when one maintains hundrets of websites, including 3rd party code, want his applications to be portable it's hard to maintain in the finfo_open() call the whole goal: if your application refuses a upload and you get the sample file be able to use the systems file-command and get the same mimetype reported as the php application got by refuse it ------------------------------------------------------------------------ [2016-09-08 11:12:31] spam2 at rhsoft dot net see https://bugs.php.net/bug.php?id=73046 for fail to use 'create_data_file.php' on Fedora 24 to get a recent 'fileinfo.so' ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=67516 -- Edit this bug report at https://bugs.php.net/bug.php?id=67516&edit=1