#21048·yii2

FileValidator `checkExtensionByMimeType` does not work if `extensions` is not set

Author: chriscptyCreated Aug 3, 2026Updated Aug 6, 2026
Labelsstatus:ready for adoption

Description

yii\validators\FileValidator has two options relating to the file extension: extensions, limiting the allowed extensions to the given ones, and checkExtensionByMimeType, which checks that the file's content matches the file type advertised by the file extension (using finfo_file).

In FileValidator::validateExtension(), those two options are checked separately: First, if checkExtensionByMimeType is truthy, the mimetype gets checked, then independently of that, if extensions is not empty, the extensions get checked. Thus, I assume the intention was that these options work independently of each other.

However, this validateExtensions function is only called if extensions is not empty, so checkExtensionByMimeType does nothing if extensions is not set.

Fixing this should be fairly trivial (I'll open a PR once a maintainer confirms whether this is indeed a bug, either to fix it or to document the behavior).

Our use case for this: We have a slightly more complex validation for which extensions are and aren't allowed that can't be represented via FileValidator, so we validate the extension outside of that, but still want the checkExtensionByMimeType logic.

Package version

dev-master (commit 3b7b08d381957bdeab48afcc7922a54101bd1648)

PHP version

8.5.3