Table of contents
Source: admin/code/tce_functions_upload.php
Functions to upload files.
Functions
F_get_active_content_extensions()
Returns the file extensions that browsers can render as active documents (markup or script).
These are never accepted for media uploads, regardless of K_ALLOWED_UPLOAD_EXTENSIONS, except ‘svg’, whose content must pass F_is_safe_svg_content().
function F_get_active_content_extensions(): list<string>
Returns: list<string>: lowercase extensions
Source: admin/code/tce_functions_upload.php:32
F_get_active_content_mime_types()
Returns the detected MIME types that browsers can render as active documents.
Any type ending in ‘+xml’ is also treated as active.
function F_get_active_content_mime_types(): list<string>
Returns: list<string>: lowercase MIME types
Source: admin/code/tce_functions_upload.php:90
F_get_allowed_upload_extensions()
Returns the lowercase extensions listed in K_ALLOWED_UPLOAD_EXTENSIONS.
function F_get_allowed_upload_extensions(): list<string>
Returns: list<string>: lowercase extensions, empty if the constant is missing or invalid
Source: admin/code/tce_functions_upload.php:135
F_get_server_script_extensions()
Returns the file extensions that web servers can execute as scripts.
These are never accepted for any upload, regardless of K_ALLOWED_UPLOAD_EXTENSIONS.
function F_get_server_script_extensions(): list<string>
Returns: list<string>: lowercase extensions
Source: admin/code/tce_functions_upload.php:59
F_get_uploaded_file_entry()
Returns the sanitized name and temporary path of a single uploaded file.
function F_get_uploaded_file_entry(string $fieldname): array{name: string, tmp_name: string}|null
Parameters:
$fieldname(string): Form field name.
Returns: array{name: string, tmp_name: string}|null: Null if no valid uploaded file or usable name is available.
Source: admin/code/tce_functions_upload.php:239
F_get_uploaded_tmp_file()
Returns an uploaded file without storing it.
The file stays in the PHP upload directory and is removed by PHP at the end of the request.
function F_get_uploaded_tmp_file(string $fieldname, list<string> $extensions): array{name: string, tmp_name: string}|false
Parameters:
$fieldname(string): Form field name containing the source file path.$extensions(list<string>): Extensions accepted by the calling context.
Returns: array{name: string, tmp_name: string}|false: Sanitized file name and temporary path, or false in case of error.
Source: admin/code/tce_functions_upload.php:319
F_is_allowed_upload()
Check if the uploaded file extension is allowed.
The extension must be listed in K_ALLOWED_UPLOAD_EXTENSIONS and must not be a server script. When $extensions is null (media uploads), active content extensions other than ‘svg’ are also rejected; otherwise the extension must be listed in $extensions.
function F_is_allowed_upload(string $filename, list<string>|null $extensions = null): bool
Parameters:
$filename(string): File name.$extensions(list<string>|null): Extensions accepted by the calling context, or null for media uploads.
Returns: bool: True if the file type is allowed.
Source: admin/code/tce_functions_upload.php:162
F_is_safe_media_content()
Check that the content of a media file cannot be rendered as an active document.
SVG files must pass F_is_safe_svg_content(). Other files are rejected when detected as markup or script, when a raster image does not decode as the declared type, or when the leading bytes contain markup tags.
function F_is_safe_media_content(string $filepath, string $extension): bool
Parameters:
$filepath(string): Path of the file to check.$extension(string): Declared file extension.
Returns: bool: True if the content is accepted.
Source: admin/code/tce_functions_upload.php:191
F_read_file_size()
returns the file size in bytes
function F_read_file_size(mixed $filetocheck): mixed
Parameters:
$filetocheck(mixed): (string) file to check (local path or URL)
Returns: mixed: file size in bytes or false in case of error
Source: admin/code/tce_functions_upload.php:345
F_sanitize_upload_filename()
Returns a safe file name for an uploaded file.
White spaces become underscores, characters outside [a-zA-Z0-9_.-] are removed and all dots except the extension separator become underscores.
function F_sanitize_upload_filename(string $name): string
Parameters:
$name(string): Original file name.
Returns: string: Sanitized file name, or an empty string if the name is not usable.
Source: admin/code/tce_functions_upload.php:117
F_upload_file()
Uploads a media file to the server.
The file name is sanitized, the extension and content are checked and existing files are never overwritten.
function F_upload_file(string $fieldname, string $uploaddir): string|false
Parameters:
$fieldname(string): Form field name containing the source file path.$uploaddir(string): Upload directory.
Returns: string|false: File name, or false in case of error.