Wordpress Contact Form 7 check file server side - wordpress

Question

Here is my problem:
In a form made by Contact Form 7 I allow the download of a pdf, jpg, or jpeg file type.
My concern is that the extension control is not fully performed.
Indeed, if I take a "test.exe" file and rename it "text.jpg", I can submit my form and there's no errors...
Is there a solution to test this? (e.g. by the mime test)
And if so where should I implement code?
Thank you in advance for your answers and sorry for my English (I am French...)

Answer 1

For those who have the same question, here my solution :
In wp-includes/functions.php :
add_filter('wpcf7_validate_file*', 'cf7_custom_file_validation', 10, 2);
add_filter('wpcf7_validate_file', 'cf7_custom_file_validation', 10, 2);
function cf7_custom_file_validation ($result, $tag) {
if ($tag->name === 'file-586') {
$contentType = mime_content_type($_FILES[$tag->name]['tmp_name']);
if ($contentType !== 'image/png' && $contentType !== 'image/jpeg' && $contentType !== 'application/pdf') {
$result->invalidate($tag, 'Ce type de fichier n\'est pas supporté');
}
}
return $result;
}

Answer 2

I found for you some usefull answers in our forum:
PHP Uploading files - image only checking
Try this answer:
<?php
function isImage($img){
return (bool)getimagesize($img);
}
?>
Posted by Jeremy Harris.
Here is manual of getimagesize()
http://php.net/manual/pl/function.getimagesize.php

Answer 3

Wordpress uses the filter upload_mimes to control what MIME types are allowed site-wide. You can customize this list by adding the following to wp-includes/functions.php:
function safe_mime_types($mime_types){
unset($mime_types['exe']); //remove .exe support
return $mime_types;
}
add_filter('upload_mimes', 'safe_mime_types', 1, 1);
You can also add acceptable MIME types:
function safe_mime_types($mime_types){
$mime_types['svg'] = 'image/svg+xml'; //add .svg support
unset($mime_types['exe']);
return $mime_types;
}
add_filter('upload_mimes', 'safe_mime_types', 1, 1);