From babf71ea56e987b8932066bf3663493c7c06eaed Mon Sep 17 00:00:00 2001
From: Manuel Raynaud <manu@raynaud.io>
Date: Tue, 13 Jan 2026 18:14:25 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(backend)=20make=20extension=20chec?=
 =?UTF-8?q?king=20case=20insensitive?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The extension check was not case insensitive. If the extension used is
in uppercase then it will fail despite it is allowed
---
 src/backend/core/api/serializers.py           |  2 +-
 .../core/tests/items/test_api_items_create.py | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/backend/core/api/serializers.py b/src/backend/core/api/serializers.py
index a3bb5dd5..43be44ba 100644
--- a/src/backend/core/api/serializers.py
+++ b/src/backend/core/api/serializers.py
@@ -435,7 +435,7 @@ class CreateItemSerializer(ItemSerializer):
 
             if settings.RESTRICT_UPLOAD_FILE_TYPE:
                 _root, extension = splitext(attrs["filename"])
-                if extension not in settings.FILE_EXTENSIONS_ALLOWED:
+                if extension.lower() not in settings.FILE_EXTENSIONS_ALLOWED:
                     logger.info(
                         "create_item: file extension not allowed %s for filename %s",
                         extension,
diff --git a/src/backend/core/tests/items/test_api_items_create.py b/src/backend/core/tests/items/test_api_items_create.py
index 98ae1aeb..5c49004f 100644
--- a/src/backend/core/tests/items/test_api_items_create.py
+++ b/src/backend/core/tests/items/test_api_items_create.py
@@ -162,6 +162,26 @@ def test_api_items_create_file_authenticated_extension_not_allowed():
     }
 
 
+def test_api_items_create_file_authenticated_extension_case_insensitive():
+    """
+    Creating a file item with an extension, no matter the case used, should be allowed.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        "/api/v1.0/items/",
+        {
+            "type": ItemTypeChoices.FILE,
+            "filename": "file.JPG",
+        },
+        format="json",
+    )
+    assert response.status_code == 201
+    item = Item.objects.exclude(id=user.get_main_workspace().id).get()
+    assert item.title == "file.JPG"
+
+
 def test_api_items_create_file_authenticated_not_checking_extension(settings):
     """
     Creating a file item with an extension not allowed should fail.