Menu
Community /Pin to ProfileBookmark
@NogDogDec 02.2008 — #If you are using the $_FILES[...]['type'] value to determine the file type, note that this is very undependable. It is not required that the browser sends it, you have no way to be sure that the browser has correctly identified it even if it sends it, and a hacker can easily spoof it.
You could try something like the[url=http://php.net/manual/en/intro.fileinfo.php]FileInfo PECL extension[/url] , though even it only claims:
@NogDogDec 03.2008 — #I like to use pathinfo() to get the extension:
Restricting File Types In Upload
I’m trying to limit what users can and can’t upload on my site, based on MIME file types, detected by the browser, so the user can’t change an extention and pass malicious code to my very, very small, humble site.
Despite my efforts as a beginner, it’s just not working. Depending on what I change, it’ll either allow EVERYTHING or allow NOTHING. URGH!
So, I’m asking for help. Below is the function, and below that is the whole script it’s sitting in
[code=php]if ($xxxx_xxxx_xxxx != “application/pdf” || “audio/mpeg” || “audio/x-mpegurl” || “audio/x-wav” || “image/bmp” || “image/gif” || “image/jpeg” || “image/tiff” || “video/mpeg” || “video/quicktime” || “video/x-la-asf” || “video/x-ms-asf” || “video/x-msvideo”)
{
echo “YOUR FILE TYPE IS NOT ALLOWED<br />”;
$ok=0;
}
else
{
echo “YOUR FILE TYPE IS APPROVED<br />YOU WILL BE REDIRECTED IN 5 SECONDS”;
$ok=1;
}
. . . and the whole thing it sits in . . .
[code=php]<?php
$target = “./”;
$target = $target . basename( $_FILES[‘uploaded’][‘name’]) ;
$ok=1;
//This is our size condition
if ($uploaded_size > 262144000)
{
echo “Your file MUST be smaller than 250MB’s.<br>”;
$ok=0;
}
//This is our limit file type condition
if ($xxxx_xxxx_xxxx != “application/pdf” || “audio/mpeg” || “audio/x-mpegurl” || “audio/x-wav” || “image/bmp” || “image/gif” || “image/jpeg” || “image/tiff” || “video/mpeg” || “video/quicktime” || “video/x-la-asf” || “video/x-ms-asf” || “video/x-msvideo”)
{
echo “YOUR FILE TYPE IS NOT ALLOWED<br />”;
$ok=0;
}
else
{
echo “YOUR FILE TYPE IS APPROVED<br />YOU WILL BE REDIRECTED IN 5 SECONDS”;
$ok=1;
}
//Here we check that $ok was not set to 0 by an error
if ($ok==0)
{
Echo “Sorry your file was not uploaded”;
}
//If everything is ok we try to upload it
else
{
if(move_uploaded_file($_FILES[‘uploaded’][‘tmp_name’], $target))
{
echo “The file “. basename( $_FILES[‘uploadedfile’][‘name’]). ” has been uploaded”;
}
else
{
echo “Sorry, there was a problem uploading your file.”;
}
}
?>
So, any help on what I’m supposed to be using, would be GREAT. As a side note, I’ve tried [ $uploaded_type ] [ $mime_content_type ] [ $mime_type ] and it’s not working.
Sign in
to post a comment15 Comments(s) ↴
0
@NogDogDec 02.2008 — #If you are using the $_FILES[...]['type'] value to determine the file type, note that this is very undependable. It is not required that the browser sends it, you have no way to be sure that the browser has correctly identified it even if it sends it, and a hacker can easily spoof it.You could try something like the
The functions in this module try to guess the content type and encoding of a file by looking for certain magic byte sequences at specific positions within the file. While this is not a bullet proof approach the heuristics used do a very good job. [/quote]
0
@NogDogDec 03.2008 — #I like to use pathinfo() to get the extension:[code=php]
$allowed = array('jpeg', 'jpg', 'gif', 'png'); // use all lower-case here
$ext = strtolower(pathinfo($_FILES['userfile']['name'], PATHINFO_EXTENSION));
if(in_array($ext, $allowed))
{
// OK, continue processing
}
else
{
// invalid file extension, return error
}
[/code]