ColdFusion 10 CFFILE Accept mimetype not recognised

Question 1

~~I will have to speculate until I can see your <cffile> code but my guess is that you have not allowed the appropriate mime type under the accept attribute of the <cffile> tag.~~

Now that you have included your code my assumption has been confirmed: you have not allowed the appropriate mime type under the accept attribute of the <cffile> tag.

See below for further details.

Several changes were made to how the <cffile> tag works in ColdFusion 10. You may or may not be aware that in ColdFusion 10 they added the strict attribute to the tag (documentation reference).

When strict is true, only MIME types or a combination of MIME types and extensions are allowed in the accept attribute. Since strict is true by default, you should specify MIME types for the accept attribute.

When strict is false, either MIME types or extensions or a combination of both can be specified as a value to the accept attribute. For more information, see this blog entry.

Not only was that attribute added, but the default value for the strict attribute is true. So because you have not specified it within your code it is on.

Note: If you receive an error like "The MIME type of the uploaded file (image/jpeg) was not accepted by the server", enter accept="image/jpeg" to accept JPEG files.

Taken from the Adobe documentation here. From the error message that you have posted an attempt was made to upload a file with mime type of "application/octet-stream". You appear to be expecting "video/x-ms-wmv". So you can try to figure out why your browser is attempting to upload the file as "application/octet-stream" or add that mime type to your accept attribute. WARNING: that will also allow other types of files to be uploaded that you probably don't want.

The cffile accept attribute uses the mime type that your browser sends to the server. Read that again... your browser tells cffile what the mime type is. It's very easy to spoof the mime type

Taken from Pete Freitag's page on Tips for Secure File Uploads with ColdFusion. (An older article but still has relevant tips.)

A couple of other references I found that may be helpful:

Question 2

You may have some odd mime type. If you use a try/catch block around your tag, you can display the full error message.

Example:

<cftry>
    <cffile accept="video/x-ms-wmv" action="upload" destination="#ExpandPath('/client-images/')#" filefield="form.UploadFile" nameconflict="makeunique">
    <cfcatch type="any">
        <cfdump var="#cfcatch#" label="cfcatch">
    </cfcatch>
</cftry>

The dump will display the mime type that ColdFusion thinks that was uploaded.

This is for development/analysis only, you wouldn't want to present the dump to regular site visitors.