# Restrict assets file type when uploading via API

**URL:** https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739
**Category:** Support
**Created:** [December 8, 2020, 3:08pm UTC](https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739 "2020-12-08T15:08:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)
#### Post date: [December 8, 2020, 3:08pm UTC](https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739/1 "2020-12-08T15:08:46Z")

</div>

It seems Cockpit allow all file types by default when uploading via “/api/cockpit/addAssets”.

Is there any proper way to just allow uploading image only ( png, gif, jpg, jpeg )?

---

<div class="post-metadata">

### Author: ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)
#### Post date: [December 15, 2020, 3:49pm UTC](https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739/2 "2020-12-15T15:49:05Z")

</div>

I found out the way to restrict without modifying cockpit code.

I use the below codes as an addon.

`bootstrap.php`

```php
<?php

/**
 * Secure Uploading Assets
 * Only allow image type (png,jpeg,jpg,gif)
 */

function validateImageType(){

        $files = $_FILES['files'];

        foreach($files['tmp_name'] as $key => $file){

            $info = getimagesize($file);

            if ($info === FALSE || ($info[2] !== IMAGETYPE_GIF) && ($info[2] !== IMAGETYPE_JPEG) && ($info[2] !== IMAGETYPE_PNG)) {

                die('Please only upload image file, thanks.');

            }

        }

    }

if(COCKPIT_API_REQUEST){
    $app->on('cockpit.rest.init', function($routes) {
        if($this['route'] == '/api/cockpit/addAssets'){
            validateImageType();
        }
    });
}

```

---

<div class="post-metadata">

### Author: ![raffaelj](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/raffaelj/32/331_2.png) [@raffaelj](https://discourse.getcockpit.com/u/raffaelj)
#### Post date: [December 18, 2020, 10:27am UTC](https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739/3 "2020-12-18T10:27:35Z")

</div>

You can also set allowed file extensions via `/path/to/cockpit/config/config.php`:

```php
return [

    // restrict allowed file extensions for assets

    // for all users
    'allowed_uploads' => 'jpg, jpeg, png, gif',

    // for groups
    'groups' => [
        'author' => [
            '$vars' => [
                'assets.allowed_uploads' => 'jpg, jpeg, png, gif'
            ],
        ]
    ],
];

```

see also:

> <https://github.com/agentejo/cockpit/blob/next/modules/Cockpit/module/assets.php#L140-L149>

---

<div class="post-metadata">

### Author: ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)
#### Post date: [December 18, 2020, 12:35pm UTC](https://discourse.getcockpit.com/t/restrict-assets-file-type-when-uploading-via-api/1739/4 "2020-12-18T12:35:57Z")

</div>

Thanks @raffaelj , this method is way more elegant than mine.