Merge branch '4.x' of https://github.com/craftcms/cms into 5.x

# Conflicts:
#	CHANGELOG.md

Author: brandonkelly

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Plugin licenses are now assigned immediately when installed via the `plugin/install` command. ([#17871](https://github.com/craftcms/cms/issues/17871))
 - Improved drag-n-drop performance. ([#18019](https://github.com/craftcms/cms/pull/18019))
+- Fixed a bug where assets with disallowed file extensions could still be uploaded to the system’s temp directory. ([#18015](https://github.com/craftcms/cms/issues/18015))
 - Fixed a bug where the Live Preview drag bar wasn’t easily draggable when a nested slideout was open. ([#17781](https://github.com/craftcms/cms/issues/17781))
 - Fixed a bug where nested slideouts within Live Preview weren’t getting resized when the window was resized.
 - Fixed a bug where element index table column sort buttons weren’t being focused after activation. ([#18021](https://github.com/craftcms/cms/pull/18021))

src/controllers/AssetsController.php

@@ -15,6 +15,7 @@
 use craft\db\Table;
 use craft\elements\Asset;
 use craft\elements\conditions\ElementCondition;
+use craft\errors\AssetDisallowedExtensionException;
 use craft\errors\AssetException;
 use craft\errors\DeprecationException;
 use craft\errors\ElementNotFoundException;
@@ -1285,6 +1286,14 @@ private function _getUploadedFileTempPath(UploadedFile $uploadedFile): string
             throw new UploadFailedException($uploadedFile->error);
         }
 
+        // Make sure the file extension is allowed
+        $allowedExtensions = Craft::$app->getConfig()->getGeneral()->allowedFileExtensions;
+        $extension = strtolower(pathinfo($uploadedFile->name, PATHINFO_EXTENSION));
+
+        if (is_array($allowedExtensions) && !in_array($extension, $allowedExtensions, true)) {
+            throw new AssetDisallowedExtensionException(Craft::t('app', "“{$extension}” is not an allowed file extension."));
+        }
+
         // Move the uploaded file to the temp folder
         $tempPath = $uploadedFile->saveAsTempFile();