WordPress user uploading photos without extensions

Question

I am with the strangest issue here. There is a writer here on my website, using WordPress 4.2.2 (but it happens for months) that keeps uploading photos with names such as ()), 00 without even an extension and for some dark reason, these images bypass the WordPress upload filter and get crazy names such as simply jpg or jpg4.

The mess is even bigger when we use our image resize system that ends creating images with names such as jpg12-250x100. (note the trailing dot).

So our CloudFlare cache breaks, the internal cache breaks and to finish up this teenager's bedroom, I am not able to reproduce this error even with superuser access. I already checked his user and he doesn't have the role to unfiltered_upload.

I don't know even how to start this investigation because I can't do it with my account. Is there any filter at the WordPress' upload system that I can search across my plugins to isolate the suspect code? I am totally blind right now.

Thanks, Vinicius.

Answer 1

You can check wp_check_filetype_and_ext to check the filetype and proper extension.

Reference: https://codex.wordpress.org/Function_Reference/wp_check_filetype_and_ext

You can use wp_handle_upload hook to process uploaded file, similar to: https://wordpress.stackexchange.com/a/38585