Validate MIME type against extensions

[Sidsector9]

See #88

[danielbachhuber]

I'm not quite sure this is the same check as #88 describes...

SHouldn't this check that $file_extension matches $file_mime_type?

[Sidsector9]

@danielbachhuber
I'm a bit confused 😅 ?
For example, a file can have an extension .jpeg with the following mime-types : image/jpeg, image/pjpeg, in case, the extension is modified to .png, the mime-type will still remain the same and return an error

[danielbachhuber]

Can you include a test for this check please?

[danielbachhuber]

It doesn't need to happen in this PR, but we should make sure the uploads directory is only iterated once for all checks, not once for each check.

See #121

[schlessera]

I'm not too keen on having a large list of MIME types that we need to update and maintain over time.

I have created a Composer plugin that pulls down the list of MIME types from the Apache HTTP Server source files and parses them so you can use them in PHP.

You can find the package here: https://github.com/brightnucleus/mime-types

This way, the list of MIME types will keep itself up-to-date.

[schlessera]

You need to check for the existence of this file first, because the folder will not exist if the package is used as a dependency, not a root package:

$autoload = dirname( __FILE__ ) . '/vendor/autoload.php';
if ( file_exists( $autoload ) ) {
	require_once $autoload;
}

[Sidsector9]

My apologies. I made the necessary changes.

[Sidsector9]

@schlessera Builds are failing because

[ErrorException]                                                                                                                                     
  array_filter() expects parameter 2 to be a valid callback, cannot access protected method BrightNucleus\MimeTypes\MimeTypesPlugin::filterComments()

Not sure why it's unable to access protected method under the same class?

[schlessera]

@Sidsector9 I don't understand either what the issue is. The code was tested and working, and there's no reason that I can see why it shouldn't work.

Regardless, I pushed a new version of the package that restructures the code to get rid of these protected calls, and bump the required version in your PR. Let's see how that goes...

Test was added.