Files with these MIME types will never be allowed as uploads if $wgVerifyMimeType is enabled.
1.35.12 (gerrit:961936, phab:T341565):
$wgMimeTypeBlacklist = [ # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', # Similarly with JavaScript itself 'application/javascript', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile', # XML files generally - T341565 'application/xml', 'text/xml', ];MediaWiki versions:
1.35 – 1.36
$wgMimeTypeBlacklist = [ # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', # Similarly with JavaScript itself 'application/javascript', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile', ];MediaWiki versions:
1.18 – 1.34
$wgMimeTypeBlacklist = [ # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile', ];
$wgMimeTypeBlacklist = array( # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile', # A ZIP file may be a valid Java archive containing an applet which exploits the # same-origin policy to steal cookies 'application/zip', # MS Office OpenXML and other Open Package Conventions files are zip files # and thus blacklisted just as other zip files. If you remove these entries # from the blacklist in your local configuration, a malicious file upload # will be able to compromise the wiki's user accounts, and the user # accounts of any other website in the same cookie domain. 'application/x-opc+zip', 'application/msword', 'application/vnd.ms-powerpoint', 'application/vnd.msexcel', );MediaWiki versions:
1.14 – 1.16
$wgMimeTypeBlacklist= array( # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile', # A ZIP file may be a valid Java archive containing an applet which exploits the # same-origin policy to steal cookies 'application/zip', );MediaWiki versions:
1.12 – 1.13
$wgMimeTypeBlacklist= array( # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Client-side hazards on Internet Explorer 'text/scriptlet', 'application/x-msdownload', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile' );MediaWiki versions:
1.5 – 1.11
$wgMimeTypeBlacklist= array( # HTML may contain cookie-stealing JavaScript and web bugs 'text/html', 'text/javascript', 'text/x-javascript', 'application/x-shellscript', # PHP scripts may execute arbitrary code on the server 'application/x-php', 'text/x-php', # Other types that may be interpreted by some servers 'text/x-python', 'text/x-perl', 'text/x-bash', 'text/x-sh', 'text/x-csh', # Windows metafile, client-side vulnerability on some systems 'application/x-msmetafile' );
If you wanted to allow html files to be uploaded:
$wgFileExtensions[] = 'html';
$wgFileBlacklist = array_diff( $wgFileBlacklist, array ('html') );
$wgMimeTypeBlacklist = array_diff( $wgMimeTypeBlacklist, array ('text/html') );
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4