TYPO3 Core

But isn't the real bug that it is possible to create any file type regardless the list of allowed types?

Edit: And that you can rename any file to have any type you like. Where is the point in denying the editor to edit e.g. php files but allow to create a php file, rename it into .txt, edit it and rename it back to .php?

depending on the interpretation of the message / or the interpretation of the whitelist.
if that whitelist should handle all file actions: the creation of other files is an error.
if that extensionlist should verify an editor can edit/modify content of these files the message is faulty.

I would prefer a clear blacklist for each user/usergroup to have individual rights: one usergroup may edit html-files, others only should be allowed to upload/rename/delete images. but that would be another feature.

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/59303

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/59409