#18153: Checkign allowed media files extensions from the client

Work Item: 18153

--HG--
branch : 1.x

src/Orchard.Web/Modules/Orchard.Media/Controllers/AdminController.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Web.Mvc;
+using Orchard.ContentManagement;
 using Orchard.Core.Contents.Controllers;
 using Orchard.Localization;
 using Orchard.Logging;
@@ -172,7 +173,21 @@ namespace Orchard.Media.Controllers {
         }
 
         public ActionResult Add(string folderName, string mediaPath) {
-            var model = new MediaItemAddViewModel { FolderName = folderName, MediaPath = mediaPath };
+            if (!Services.Authorizer.Authorize(Permissions.ManageMedia, T("Couldn't upload media file")))
+                return new HttpUnauthorizedResult();
+            
+            var currentSite = Services.WorkContext.CurrentSite;
+
+            var model = new MediaItemAddViewModel {
+                FolderName = folderName, 
+                MediaPath = mediaPath,
+                AllowedExtensions = currentSite.As<MediaSettingsPart>().UploadAllowedFileTypeWhitelist
+            };
+
+            if(currentSite.SuperUser.Equals(Services.WorkContext.CurrentUser.UserName, StringComparison.Ordinal)) {
+                model.AllowedExtensions = String.Empty;
+            }
+
             return View(model);
         }
 
@@ -196,8 +211,8 @@ namespace Orchard.Media.Controllers {
                 try {
                     _mediaService.UploadMediaFile(viewModel.MediaPath, Request.Files[fileName], viewModel.ExtractZip);
                 }
-                catch (ArgumentException) {
+                catch (ArgumentException e) {
-                    Services.Notifier.Error(T("Uploading media file failed:"));
+                    Services.Notifier.Error(T("Uploading media file failed: {0}", e.Message));
                     return View(viewModel);   
                 }
             }

src/Orchard.Web/Modules/Orchard.Media/Services/MediaService.cs

@@ -15,7 +15,7 @@ using Orchard.Validation;
 
 namespace Orchard.Media.Services {
     /// <summary>
-    /// The MediaService class provides the services o manipulate media entities (files / folders).
+    /// The MediaService class provides the services to manipulate media entities (files / folders).
     /// Among other things it provides filtering functionalities on file types.
     /// The actual manipulation of the files is, however, delegated to the IStorageProvider.
     /// </summary>
@@ -251,8 +251,16 @@ namespace Orchard.Media.Services {
 
                 // must be in the whitelist
                 MediaSettingsPart mediaSettings = currentSite.As<MediaSettingsPart>();
-                if (mediaSettings == null ||
+                
-                    !mediaSettings.UploadAllowedFileTypeWhitelist.ToUpperInvariant().Split(' ').Contains(extension.ToUpperInvariant())) {
+                if (mediaSettings == null) {
+                    return false;
+                } 
+                
+                if(String.IsNullOrWhiteSpace(mediaSettings.UploadAllowedFileTypeWhitelist)) {
+                    return true;
+                } 
+
+                if(!mediaSettings.UploadAllowedFileTypeWhitelist.ToUpperInvariant().Split(' ').Contains(extension.ToUpperInvariant())) {
                     return false;
                 }
             }

src/Orchard.Web/Modules/Orchard.Media/ViewModels/MediaItemAddViewModel.cs

@@ -7,5 +7,6 @@
         public string FolderName { get; set; }
         public string MediaPath { get; set; }
         public bool ExtractZip { get; set; }
+        public string AllowedExtensions { get; set; }
     }
 }

src/Orchard.Web/Modules/Orchard.Media/Views/Admin/Add.cshtml

@@ -32,4 +32,25 @@
         <button class="primaryAction" type="submit">@T("Upload")</button>
         @Html.AntiForgeryTokenOrchard()
     </fieldset>
+}
+
+@using(Script.Foot()) {
+<script type="text/javascript">
+//<![CDATA[
+    $(function () {
+        $('#MediaItemPath').change(function () {
+            var $in = $(this);
+            var allowedExtensions = ' @Model.AllowedExtensions ';
+            var filename = $in.val();
+            var ext = filename.slice(filename.lastIndexOf(".")).toLowerCase();
+            var allowed = allowedExtensions == '  ' || allowedExtensions.indexOf(ext) != -1;
+
+            if(!allowed) {
+                $('#messages>div').append($('<div class="message message-Error">@T("Can't upload file. Supported file types are {0}.", Model.AllowedExtensions).Text</div>'));
+                return false;
+            }
+        });
+    })
+//]]>
+</script>
 }