diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java index f6e17b871a6..a2d5e8f0e77 100644 --- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java +++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java @@ -207,7 +207,13 @@ public static boolean isValidFile(String fileToCheck, String fileType, Delegator // PDF files are not concerned because they may contain several CharSet encodings // hence no possibility to use Files::readAllLines that needs a sole CharSet if (!isPdfFile(fileToCheck)) { - if (!checkMaxLinesLength(fileToCheck)) { + if (getMimeTypeFromFileName(fileToCheck).equals("application/x-tika-msoffice")) { + Debug.logError("File : " + fileToCheck + ", is a MS Office file." + + " It can't be uploaded for security reason. Try to transform a Word file to PDF, " + + "and an Excel file to CSV. For other file types try PDF.", MODULE); + return false; + } + if (!isValidImageIncludingSvgFile(fileToCheck) && !checkMaxLinesLength(fileToCheck)) { Debug.logError("For security reason lines over " + MAXLINELENGTH.toString() + " are not allowed", MODULE); return false; }