Thank you so much for your contribution.
First of all, for beginners who struggle and cannot get rid of mime detection issues : Desactivate it, removing the source code in the classes/file.php
AND : when you desactivate the mime, you cannot anymore use the {MIMEXT} tag for rewrite.
Use {EXT} tag
Each version of php 5.2, 5.3, Win, Unix... has different way to get the mime.
This is why you can see that your component try all theses methods one after the other.
You can copy the source code in Joomla native com_media helper, BUT be aware that the mime detection is called ONLY if some mimes has been configurated as forbidden. By default, it do not check it (if I remember well).
So, you can copy the source from com_media, and see that it is not working in your component ;-(
But, in facts this is because that source you copy from com_media it is often not called at all.
There has been some posts about that in this forum. So before thinking Cook generated wrong (wich is possible), please try a single php test outside of your component.
I want to precise also that the mimes types in Cook Builder interface are only for example. You can add as many as you want on this not exahustive list. The idea was to do not get you confuse in thousands of different and specific mime types.
I precise again that mime detection is not for security !!! (only ergonomy, and extension rewrite)
So, you can accept all the files you want while you use the indirect file access. (url call through index.php)
Hope it can help.
What is interesting is that you do not have direct access to the file
Yes. Absolutly
and the link can only download it.
Yes and no. If the mime is not an image, then it will force the download with no risk of execution.
If you call an image file you should specify in url that it is for download. If not, the image will be entirely outputed with an image header type, so you can show it. (indirect access)
I tried to force upload a php file but not run. What is good!
Yes. And even if you don't specify 'download' in url, it will force download because not allowed to execute.