Fix #18094: Support for composite file extension validation

framework/CHANGELOG.md

@@ -28,6 +28,7 @@ Yii Framework 2 Change Log
 - Bug #18031: HttpBasicAuth with auth callback now triggers login events same was as other authentication methods (samdark)
 - Bug #18134: Expression as columnName should not be quoted in likeCondition (darkdef)
 - Bug #18147: Fixed parameters binding for MySQL when prepare emulation is off (rskrzypczak)
+- Bug #18094: Support for composite file extension validation (darkdef)
 
 
 2.0.35 May 02, 2020

framework/assets/yii.validation.js

@@ -408,10 +408,18 @@ yii.validation = (function ($) {
 
     function validateFile(file, messages, options) {
         if (options.extensions && options.extensions.length > 0) {
-            var index = file.name.lastIndexOf('.');
+            var found = false;
-            var ext = !~index ? '' : file.name.substr(index + 1, file.name.length).toLowerCase();
+            var filename = file.name.toLowerCase();
 
-            if (!~options.extensions.indexOf(ext)) {
+            for (var index=0; index < options.extensions.length; index++) {
+                var ext = options.extensions[index].toLowerCase();
+                if (filename.substr(filename.length - options.extensions[index].length - 1) === ('.' + ext)) {
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found) {
                 messages.push(options.wrongExtension.replace(/\{file\}/g, file.name));
             }
         }

framework/validators/FileValidator.php

@@ -11,6 +11,7 @@ use Yii;
 use yii\helpers\FileHelper;
 use yii\helpers\Html;
 use yii\helpers\Json;
+use yii\helpers\StringHelper;
 use yii\web\JsExpression;
 use yii\web\UploadedFile;
 
@@ -412,7 +413,12 @@ class FileValidator extends Validator
             }
         }
 
-        if (!in_array($extension, $this->extensions, true)) {
+        if (!empty($this->extensions)) {
+            foreach ((array) $this->extensions as $ext) {
+                if (StringHelper::endsWith($file->name, ".$ext", false)) {
+                    return true;
+                }
+            }
             return false;
         }
 

tests/framework/validators/FileValidatorTest.php

@@ -452,6 +452,32 @@ class FileValidatorTest extends TestCase
         $this->assertNotFalse(stripos(current($m->getErrors('attr_exe')), 'Only files with these extensions '));
     }
 
+    public function testValidateAttributeDoubleType()
+    {
+        $val = new FileValidator([
+            'extensions' => 'tar.gz, tar.xz',
+            'checkExtensionByMimeType' => false,
+        ]);
+
+        $m = FakedValidationModel::createWithAttributes(
+            [
+                'attr_tar' => $this->createTestFiles([['name' => 'one.tar.gz']]),
+                'attr_bar' => $this->createTestFiles([['name' => 'bad.bar.xz']]),
+                'attr_badtar' => $this->createTestFiles([['name' => 'badtar.xz']]),
+            ]
+        );
+        $val->validateAttribute($m, 'attr_tar');
+        $this->assertFalse($m->hasErrors('attr_tar'));
+
+        $val->validateAttribute($m, 'attr_bar');
+        $this->assertTrue($m->hasErrors('attr_bar'));
+        $this->assertNotFalse(stripos(current($m->getErrors('attr_bar')), 'Only files with these extensions '));
+
+        $val->validateAttribute($m, 'attr_badtar');
+        $this->assertTrue($m->hasErrors('attr_badtar'));
+        $this->assertNotFalse(stripos(current($m->getErrors('attr_badtar')), 'Only files with these extensions '));
+    }
+
     public function testIssue11012()
     {
         $baseName = '飛兒樂團光茫';
@@ -496,6 +522,7 @@ class FileValidatorTest extends TestCase
             ['test.txt', 'text/*', 'txt'],
             ['test.xml', '*/xml', 'xml'],
             ['test.odt', 'application/vnd*', 'odt'],
+            ['test.tar.xz', 'application/x-xz', 'tar.xz'],
         ]);
     }