Description: ------------ When trying to make a new bug and upload a patch to it, the bug tracker threw out an error message saying that I should upload the patch in mimetype "text/plain". I should rename it to patch.txt. I renamed it (the patch was created using standerd diff tools on Linux), but uploading didn't work - again, the same problem. I'm using Firefox 2.0.0.4.

It works ok in konqueror, so the patch file is really ok.

Hmm standard diff tools ? You mean diff itself ? Have you tried cvs diff -u file.php > file.diff Thanks

Standard diff, but since I don't have cvs access to pear, I made it by doing: diff -u oldfile.php newfile.php > patch.diff Anyway, I could upload the same file without problems in Konqueror... Take a look at it here: http://pear.php.net/bugs/patch-display.php?bug=11241&patch=add-onclick-support&revision=latest

Robert, can you please upload your patch on the following test form with your two browsers? http://www.markwiesemann.eu/tmp/mimetype.php Please report back which type is displayed after you have submitted the form.

Yes. I tried with 2 files, patch.diff and patch.txt: Firefox: [name] => patch.diff [type] => text/x-patch [name] => patch.txt [type] => application/x-txt Konqueror: [name] => patch.diff [type] => text/x-diff [name] => patch.txt [type] => text/plain

Okay, we should add at least "application/x-txt" to the allowed types then. "text/x-patch" and "text/x-diff" also wouldn't be a problem (=> security). Any comments?

go for it Mark

This bug has been fixed in CVS. If this was a documentation problem, the fix will appear on pear.php.net by the end of next Sunday (CET). If this was a problem with the pear.php.net website, the change should be live shortly. Otherwise, the fix will appear in the package's next release. Thank you for the report and for helping us make PEAR better.

I want to add my "report" because as far as I can see in CVS this issue is not yet fixed: When I try to upload a patch, I don't get past the following: Error: uploaded patch file must be text file (save as e.g. "patch.txt" or "pack It's a .diff file, ASCII. My take: You are using HTTP_Upload to verify the uploaded file is text/plain, and this is flawed for two reasons. 1) HTTP_Upload only proxies $_FILES, which contains information from the browser, because the browser doesn't know .diff (or .patch) it will assume application/whatever instead of text/plain. What it assumes can differ on many systems. I have no idea what it assumes right now, I created my file on Windows it's ASCII (I can email the file since I won't be able to attach it here). 2) This is also related to security because $_FILES is generated on the client-side (by the browser), I could write my own client and inject binary data here and claim it's text/plain. The workaround is to either use MIME_Type or File_Info.

Till, let's keep this problem in one bug report. Bug #12946 is currently open, I'll copy your comment to that bug.