Image field file extension validation doesn't work when the Number of values is set to more than one.
the file extension validation work on the first row, but after second row it doesn't return any warning message when I upload mp3 file or text file or etc.

event though it doesn't upload any files that are not allowed file type, this could be problematic when this field is working with field collection module.

I set image with caption field collection field that contain image field and text field.
and set the number of value as unlimited.

the first row was successfully validated when I try to upload mp3 file instead of image file, but when I added the second row and I tried upload mp3 file, it didn't return any error message and I was able to save the node with empty image field even though it was required field. (see the attached images)

CommentFileSizeAuthor
Capture.JPG48.52 KBethan.han777
Capture2.JPG40.05 KBethan.han777

Comments

donutdan4114’s picture

donutdan4114 commented

Possible duplicate of #1289062: Required fields in collection not validated when empty

Perhaps try applying this patch and see if the issue is fixed:
http://drupal.org/files/field_collection-required_fields_not_validated_w...

David_Rothstein’s picture

David_Rothstein commented
Title: Image field file extension validation doesn't work for the field after second. » JavaScript error message for incorrect image field extension doesn't work for the second upload
Priority: Major » Normal
Status: Active » Closed (duplicate)

I can reproduce a version of this with Drupal core alone - if you've already uploaded an image, then the second upload (regardless of whether it's a second file input on a multivalued field, or the same file input after hitting the remove button) does not get the file validation.

If that's what's going on here, then it's a duplicate of #1074214: Wrong file extension JS error is hidden after an upload has already been attempted (e.g., after adding then removing a file). If not, then it sounds like a Field Collection bug.

To clarify, the only issue here seems to be with the client-side (JavaScript) validation. As far as I can see, the server-side validation still works and prevents the upload from actually happening, so there is no way to actually bypass the validation... If I'm wrong, then this is a security issue which needs to be reported to the security team privately rather than discussed here.