How do I restrict file upload to certain extensions on Rails

Question

Am trying to allow files to be uploaded by having extensions of .xls and .xlsx. So, in the file selection window it must allow only files with these extension.

Using the below code for doing file upload in Rails

  <%= form_for @book, :url => book_path, :method => :post do |f| %>
      <div class="file_input" id="import">
        <%= f.file_field(:excel_file) %>
      </div>
  <% end %>

So, how do i allow files only with these (.xls, .xlsx) extensions ?

if you use carrierwave, you can define `extension_white_list` — apneadiving, Aug 23 '12 at 07:36
This is what you are looking for http://stackoverflow.com/a/1685834/663870 — emrahbasman, Aug 23 '12 at 07:52

score 0 · Accepted Answer · answered Aug 23 '12 at 08:19

0

You shouldn't really because it's a security risk. Rather use a gem like Paperclip or Carrierwave. There are Railscasts for both to get you started on using them.

answered Aug 23 '12 at 08:19

Simpleton

6,285
11
53
87

This doesn't answer the question. – lobati Aug 23 '22 at 16:54

score 0 · Answer 2 · answered Aug 23 '22 at 16:57

You can pass an accept option to the file_field form helper:

<%= f.file_field(:excel_file, accept: "application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet") %>

MDN has a list of common mime types for convenient reference.

How do I restrict file upload to certain extensions on Rails

2 Answers2