I am restricting file upload in the portal. i have already added these to the accept MIME Types field:
image/bmp;text/csv;application/msword;image/gif;image/jpeg;audio/mpeg;video/mp4;video/mpeg;image/png;application/pdf;application/vnd.ms-powerpoint;text/plain;image/webp;application/vnd.ms-excel;application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;application/vnd.openxmlformats-officedocument.presentationml.presentation;application/vnd.openxmlformats-officedocument.wordprocessingml.document;image/heic;image/webp
as well as setting the Allowed mime types in the admin center.
i am still able to upload .ics, exe files masked as .mp4 file extensions.
Additionally we have added a custom javascript to restrict file uploads
$('#AttachFile').attr('multiple', false);
$('#AttachFile').attr('accept', '.mp4,.pdf,.jpg,.png,.heic,.webp');
$('#AttachFile').on('change', function () {
var filePath = $(this).val();
var allowedExtensions = /(\.mp4|\.pdf|\.jpg|\.png|\.heic|\.wedp)$/i;
if (!allowedExtensions.exec(filePath)) {
alert('Invalid file type');
$(this).val('');
return false;
}
