MediaHub 1.9: better support for non-image files

I've spent a lot of time on MediaHub's image features. Cropping, presets, the picker, the detail view. Images are where the value is most visible, and they're what I reach for when I'm showing the module off. But a media library that only handles images well is half a media library.

The truth is, non-image files didn't get enough attention early on. You could upload a PDF or a spreadsheet and it would work, but the experience felt like an afterthought. Blank thumbnails in the grid. A "Crops" counter showing zero on a Word document. The upload scanner rejecting a perfectly valid WAV file because its binary data happened to contain the bytes <?=. None of these were showstoppers, but together they made file support feel unfinished.

Version 1.9 fixes that.

File-type icons

Non-image assets now display a contextual icon in the library grid, list view, detail page, and inputfield picker. PDFs and Word documents get a document icon. Spreadsheets get a spreadsheet icon. Audio, video, and presentations each get their own. The icons are from Lucide, the same icon set MediaHub already uses throughout its admin UI, so they look right at home.

Previously, non-image files tried to render the file URL as an image thumbnail. That meant a broken or blank preview for anything that wasn't a JPEG or PNG. Now the module knows the difference and shows the right thing.

Smarter upload scanning

MediaHub scans uploaded files for suspicious content: PHP tags, script blocks, eval calls. That's good practice for text-based files. It's not good practice for binary files.

Binary formats like WAV, MP3, MP4, DOCX, XLSX, PPTX, and PDF store data as raw bytes. Those bytes occasionally line up into sequences that look like <?= or <script when read as text. It's pure coincidence, but the scanner didn't know that. It would flag a valid audio file as suspicious and reject it.

The fix is straightforward: binary formats are now excluded from the text-pattern scan entirely. They're still protected by MIME validation, extension checks, and double-extension detection. The text scan now only runs on formats where a PHP tag could actually execute: plain text, CSV, SVG, and anything else that isn't a known binary format.

New default extensions

Two new file types are included in the default allowed extensions list: pptx (PowerPoint) and csv (comma-separated values). Both are common enough in real-world content workflows that they should be there out of the box.

The full default list is now:

jpg jpeg png gif pdf doc docx xls xlsx pptx csv mp3 mp4 wav

You can still customise this in Modules > Configure > MediaHub under Allowed file extensions.

Detail page cleanup

The asset detail page was designed for images, and some of that leaked through when viewing other file types. The "Crops" counter in the header stats showed "0 Crops" for every PDF, every spreadsheet, every audio file. The Crops section below the preview was already hidden for non-images, but the stat cube in the header wasn't. That's fixed now.

Long MIME type strings (looking at you, application/vnd.openxmlformats-officedocument.wordprocessingml.document) also had a habit of running off the edge of the file information card. They now wrap properly.

A note on SVG

SVG is not in the default list and uploads are blocked by default. SVG files are XML documents that can contain embedded JavaScript, event handlers, and external entity references. Allowing them without sanitisation is a security risk.

Proper SVG support (upload with sanitisation, safe rendering in the admin) is something I want to do properly rather than quickly. For now, if you need SVG support, it's a deliberate opt-in decision for your project rather than a default.

What's next

PDF first-page thumbnails are on the roadmap. Rather than showing a generic document icon, the detail view and library grid would render the first page of a PDF as a visual preview. This needs to be done carefully (server dependencies, processing time on upload) so it's coming as a separate update rather than being rushed into this one.

Download

MediaHub 1.9 is available from the downloads page. The full changelog is in the documentation.