I've been trying to fix this one on the OpenOffice.org Wiki for a while, but am getting nowhere... maybe someone here has an idea? I've defined these mime types in both the apache2/conf/mime.types file and in the wiki/includes/mime.types file: application/vnd.oasis.opendocument.chart odc application/vnd.oasis.opendocument.chart-template otc application/vnd.oasis.opendocument.database odb application/vnd.oasis.opendocument.formula odf application/vnd.oasis.opendocument.formula-template otf application/vnd.oasis.opendocument.graphics odg application/vnd.oasis.opendocument.graphics-template otg application/vnd.oasis.opendocument.image odi application/vnd.oasis.opendocument.image-template oti application/vnd.oasis.opendocument.presentation odp application/vnd.oasis.opendocument.presentation-template otp application/vnd.oasis.opendocument.spreadsheet ods application/vnd.oasis.opendocument.spreadsheet-template ots application/vnd.oasis.opendocument.text odt application/vnd.oasis.opendocument.text-master odm application/vnd.oasis.opendocument.text-template ott application/vnd.oasis.opendocument.text-web oth application/vnd.openofficeorg.extension oxt These should be correctly defined according to the standards outlined here: http://www.iana.org/assignments/media-types/ These file extensions are also defined in the $wgFileExtensions variable in LocalSettings.php. This seems to be working except for the OXT definition - the last one. When a Wiki user attempts to upload an OXT file to the Wiki they get an error message: ============ The file is corrupt or has an incorrect extension. Please check the file and upload again. ============ I've checked the file with file -bi and it returns application/x-zip. Since this does not match what the file really is (ie application/vnd.openofficeorg.extension) then the error is returned. So, my question is... what needs to be done to convince the Wiki that the OXT file is really application/vnd.openofficeorg.extension? Is this an error in the creation of the OXT file? or possibly something I've done wrong on the Wiki admin side? or... ?? C. _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

I've been trying to fix this one on the OpenOffice.org Wiki for a while, but am getting nowhere... maybe someone here has an idea? I've defined these mime types in both the apache2/conf/mime.types file and in the wiki/includes/mime.types file: application/vnd.oasis.opendocument.chart odc application/vnd.oasis.opendocument.chart-template otc application/vnd.oasis.opendocument.database odb application/vnd.oasis.opendocument.formula odf application/vnd.oasis.opendocument.formula-template otf application/vnd.oasis.opendocument.graphics odg application/vnd.oasis.opendocument.graphics-template otg application/vnd.oasis.opendocument.image odi application/vnd.oasis.opendocument.image-template oti application/vnd.oasis.opendocument.presentation odp application/vnd.oasis.opendocument.presentation-template otp application/vnd.oasis.opendocument.spreadsheet ods application/vnd.oasis.opendocument.spreadsheet-template ots application/vnd.oasis.opendocument.text odt application/vnd.oasis.opendocument.text-master odm application/vnd.oasis.opendocument.text-template ott application/vnd.oasis.opendocument.text-web oth application/vnd.openofficeorg.extension oxt These should be correctly defined according to the standards outlined here: http://www.iana.org/assignments/media-types/ These file extensions are also defined in the $wgFileExtensions variable in LocalSettings.php. This seems to be working except for the OXT definition - the last one. When a Wiki user attempts to upload an OXT file to the Wiki they get an error message: ============ The file is corrupt or has an incorrect extension. Please check the file and upload again. ============ I've checked the file with file -bi and it returns application/x-zip. Since this does not match what the file really is (ie application/vnd.openofficeorg.extension) then the error is returned. So, my question is... what needs to be done to convince the Wiki that the OXT file is really application/vnd.openofficeorg.extension? Is this an error in the creation of the OXT file? or possibly something I've done wrong on the Wiki admin side? or... ?? C. _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

This may be a more generic problem, see: https://bugzilla.wikimedia.org/show_bug.cgi?id=18684 - Uploading office 2007 files (docx, pptx etc) results in error. When I mentioned this on-line one time, someone pointed out the problem with having a mime.types file specifically for MediaWiki when it probably should be dynamically resolved. I forget the exact suggestion, but there are security bypass issues and maybe we should take a look at implementing more generically.

> As a workaround you can try modifying includes/mime.types and > add the line: > > application/x-zip oxt > > since I don't see a application/x-zip line in the version > 1.15.1 mime.types file, in which case you could just add > "oxt" to the line. > > This will fool Mediawiki into matching the x-zip mime type > with the "oxt" extension and allow the upload.

> I think the problem is in "file", not the wiki nor anything > you've done to it. :-) > > Specifically, you say that a "file -bi" reports those files > as being application/x-zip. > If I correctly recall some similar struggles I've had, that's > the place to focus - convince "file" that what it is *really* > is the MIME type for oxt.

OOXML formats are zip achives. It is likely the only way to correctly identify them is to extract the files from the zip archive and validate them as being office 2007 format. I think the same method was mentioned for OpenDocument files, except OpenDocument has a validator available. I can't find my previous post on this, but I provided a dirty, dirty hack for allowing OOXML uploads. Like the patch in the bug report, it opens a hole for exploits; but, without validation, I think any fix would open a hole for exploits.

Since OpenDocument files are Zip files, unless you do some extra validation, a Jar could be uploaded disguised as an OD? file. The vulnerability is that a Jar have same-origin permissions over the wiki, and so -linked from an external page viewed by logged-in users- can do all kinds of Bad Things.