Problem/Motivation
Changes while moving filefield to core removed the ability for administrators to allow all file extensions in file fields. While greatly improving security for sites which allow end users to submit files, on single- or few-user sites it is incredibly difficult to manually allow an inclusive list of file extensions. There needs to be more flexibility in how file extensions are checked.
Proposed resolution
Provide a radio option above the allowed file extensions field for administrators to set either allow "Only the listed extensions" or "All extensions except those listed". Using "All extensions except those listed" with a blank list of extensions will allow all extensions. The default option will be "Only the listed extensions".
Remaining tasks
- Patch review
- Update form validation test (maybe?)
User interface changes
- New option fields on the File widget settings form
- Updated validation text for the File widget
Original report by droplet
edit field -> Allowed file extensions
no way to allow all file extensions