wp_check_filetype_and_ext │ filter-hook │ WP 3.0.0

Allows you to inspect an uploaded file and change its actual type (MIME type).

When a file is uploaded, WordPress checks its actual type rather than the type implied by its filename extension. This is done by wp_check_filetype_and_ext(). The filter lets you change the result returned by that function.

When is the hook useful?

For example, when file uploads of different sizes, types, extensions, or names should be permitted or prohibited depending on user roles or other conditions.

Suppose SVG file uploads should be allowed, and the SVG MIME type has been added to the permitted MIME types:

add_filter( 'upload_mimes', function ( $mimes ) {
	$mimes['svg'] = 'image/svg+xml';
	return $mimes;
} );

Attempting to upload an SVG file produces an error:

This happens because after wp_check_filetype_and_ext() checks the file, the actual MIME type of the SVG is detected as 'text/plain', and the function returns empty file type data because validation failed.

The filter can supply custom data to correct this. Be careful: incorrect code can allow any user to upload any type of file. See the examples below for a working solution.

Usage

add_filter( 'wp_check_filetype_and_ext', 'wp_kama_check_filetype_and_ext_filter', 10, 5 );

/**
 * Function for `wp_check_filetype_and_ext` filter-hook.
 * 
 * @param array         $wp_check_filetype_and_ext Values for the extension, mime type, and corrected filename.
 * @param string        $file                      Full path to the file.
 * @param string        $filename                  The name of the file (may differ from $file due to $file being
 *                                    in a tmp directory).
 * @param string[]|null $mimes                     Array of mime types keyed by their file extension regex, or
 *                                    null if none were provided.
 * @param string|false  $real_mime                 The actual mime type or false if the type cannot be
 *                                    determined.
 *
 * @return array
 */
function wp_kama_check_filetype_and_ext_filter( $wp_check_filetype_and_ext, $file, $filename, $mimes, $real_mime ){
	// filter...
	return $wp_check_filetype_and_ext;
}

$data(array)

File data as an array with these keys:

• ext — extension, for example txt (file.txt).
• type — MIME type, for example text/plain.
• proper_filename — correct filename.
  • When specified, replaces the 'name' element in the uploaded file data, the name from $_FILES['name'].
  • When omitted, the original name is used.

$file(string)

Path to the file. For example: userdata\temp\phpF581.tmp.

$filename(string)

Filename, for example wp-amp-plugin_043848.svg.

$mimes(array/false)

Array of permitted extension names and file types. false means that values from get_allowed_mime_types() are used.

$real_mime(string/true/false)

Actual MIME type, or false when the MIME type could not be obtained.

Examples

#1 Demonstrate the values passed to the filter

add_filter( 'wp_check_filetype_and_ext', 'filter_function_name_497', 10, 4 );
function filter_function_name_497( $wp_check_filetype_and_ext, $file, $filename, $mimes ){

	/*
	$wp_check_filetype_and_ext

	// When the file fails validation.
	array(
		[ext]  =>
		[type] =>
		[proper_filename] =>
	)

	// For a .txt file.
	array(
		[ext]  => txt
		[type] => text/plain
		[proper_filename] =>
	)

	$file     = C:\OpenServer\userdata\temp\phpF581.tmp
	$filename = wp-plugin_043848.svg
	$mimes    = false // Default list.
	*/

	return $wp_check_filetype_and_ext;
}

#2 Allow SVG files to be uploaded to WordPress

The example is provided in a separate article.