Lord of the Files: Enhanced Upload Security

by Blobfolio

Description

WordPress relies mostly on name-based validation when deciding whether or not to allow a particular file, leaving the door open for various kinds of attacks.

Lord of the Files adds to this content-based validation and sanitizing, making sure that files are what they say they are and safe for inclusion on your site.

The main features include:

Robust real filetype detection;
Full MIME alias mapping;
SVG sanitization (if SVG uploads have been independently allowed);
File upload validation debugger;
Fixes issues related to #40175 that have been present since WordPress 4.7.1.
Fixes ambiguous media extensions #40921

Requirements

WordPress 5.2 or later.
PHP 7.4 or later.
dom PHP extension.
fileinfo PHP extension.
mbstring PHP extension.
xml PHP extension.

Please note: it is not safe to run WordPress atop a version of PHP that has reached its End of Life. Future releases of this plugin might, out of necessity, drop support for old, unmaintained versions of PHP. To ensure you continue to receive plugin updates, bug fixes, and new features, just make sure PHP is kept up-to-date. 🙂

Privacy Policy

This plugin does not make use of or collect any “Personal Data”.

Installation

Nothing fancy! You can use the built-in installer on the Plugins page or extract and upload the blob-mimes folder to your plugins directory via FTP.

To install this plugin as Must-Use, download, extract, and upload the blob-mimes folder to your mu-plugins directory and follow the third example listed under Caveats; the main file for this plugin is blob-mimes/index.php.

Please note: MU Plugins are removed from the usual update-checking process, so you will need to handle all future updates manually.

Screenshots

Example output from Tools > Debug File Validation.
The plugin includes a settings wizard under Settings > File Settings.

Faq

Does this require any theme or config changes?

This plugin is intended to be an activate-and-forget sort of affair for most users. All features are enabled by default.

But if you’re a developer or system administrator, you might take a peek at Tools > File Validation Reference for a list of public filters you can hook into to change things up, and Settings > File Settings for global configuration overrides.

This has mostly helped but I am still having trouble with one file…

While this plugin extends MIME alias handling more than 20-fold(!), we are still busy tracking down all the edge cases.

Please go to Tools > Debug File Validation and post the output from that page into a new support ticket for this plugin.

We’ll gladly see if we can cook up a fix or workaround!

Does this plugin enable SVG support?

No. This plugin does not modify your site’s allowed upload types (see e.g. upload_mimes for that). However if SVGs are otherwise enabled for your site, this plugin will sanitize them at the upload stage to make sure they do not contain any dangerous exploits.

There are a number of SVG-related filters that can be used to modify the sanitization behavior. Take a look at Tools > File Validation Reference for more information.

If you find the filters too aggressive, add const LOTF_NO_SANITIZE_SVGS = true; to your wp-config.php to disable the extra sanitizing.

Reviews

Fixed Font Upload Issue

By applecrusher on February 27, 2023

This fixed an issue we were having where a valid font type wasn't uploading. Thank you.

Allows .ai file uploads now

By euphemism on May 16, 2022

After trying every kind of edit recommended in StackExchange to wp-config & functions.php, adding another plugin (WP Extra File Types), looking through log files, being on the phone for an hour with WP Engine, Gravity Forms pointed me to this, and instantly, the file upload for adobe illustrator files worked. I tried disabling WP Extra File Types, but apparently that is still required.

Fixed very fast

By cangevendi on January 29, 2022

Update comes to fixed the issue very quickly after reporting

Excellent for adding support to new image file formats

By Kakemphaton (johanneseva) on May 16, 2021

Excellent plugin. Even if the description doesn't say it, this plugin allows AVIF file uploads in WordPress in two steps: – Add functions.php support for AVIF mime types (in child theme if possible): easy procedure with lots of tutorials available. – Install "Lord of the Files" Now you can upload AVIF in WordPress Media manager. To the authors: Thank you! The plugin description does not mention AVIF or other new image formats. It would be useful to a lot of users!

I was skeptical at first

By courageous999 on November 4, 2020

WordPress was falsely detecting a perfectly valid MP4 file with the "Sorry, this file type is not permitted for security reasons" whereas it had no problems letting me upload other MP4 files. I was told that this plugin has a decent chance at solving that problem and to my surprise it did!!! Nice work on the plugin guys. Job well done solving WordPress' own faults.

Incredibly useful debug tool

By CatchThePigeon on January 21, 2020

File Validation Debug tool very useful to work out any issues

thanks!

By tmuka on September 5, 2019

this plugin made the wpmu file upload list work to allow correctly svg and other types. thank you!

Works great network-activated on multisite

By buddywhatshisname (vhmarkgmailcom) on March 12, 2019

Works great network-activated on multisite.

Absolutely fabulous

By amuzaj on November 6, 2017

I dealt with upload issues and Josh (along with his creation - the LoTF plugin) helped mi to solve them.

cool

By Jakob Helmer (Jakobuz) on August 22, 2017

thanks, this helped me out!

Changelog

1.4.2

[Misc] Update MIME database.

1.4.1

[Misc] Update MIME database.

1.4.0

[Misc] Update MIME database.

1.3.21

[Misc] Update MIME database.

1.3.20

[Misc] Update MIME database.