Image upload php script.

[Bob]

Hello everyone !!!
I have a very neat script to download files to the server, the problem is
that it uploads all kind of files, txt, exe, zip,
you name it. I have been trying to add some code but still can't get it to
work. What I would like the script to do is only to allow the jpg, jpeg,
bmp, gif files to be downloaded. Can anyone can give me a hand?
Thanks in Advance, Bob.
This is the script. >>>>>>>>>>>>>>> >>>>>>
<form name="upload" enctype="multip art/form-data" method="post" action="">
<input type="file" name="file" />
<br /><input type="submit" name="submit" value="Upload" />

<?php

if(isset($_POST['submit'])) {

$dir = "files/"; //Upload directory
$error = ""; //Setting a false error
$address = "http://".$_SERVER['HTTP_HOST']."/"; //Getting the web address
$file_name = $_FILES['file']['name']; //Getting the file name
$file_type = $_FILES['file']['type']; //Getting the file type
$file_size = "".$_FILES['file']['size']." bytes"; //Getting the file size
$file_tmp = $_FILES['file']['tmp_name']; //Setting the temporary name
$file_address = $address.$dir.$ file_name; //URL of file

if(file_exists( $dir.$file_name )) {
$error = "<br />Error: A file with the same name already exists!";
}

else {
@copy ($file_tmp, $dir.$file_name ) or ($error="<br />Error: File could not
be copied!");
}

if($error != "") {
echo $error;
}

else {
echo "<br />File successfully uploaded!\n";
echo "<br />Name: ".$file_name."\ n";
echo "<br />Size: ".$file_size."\ n";
echo "<br />Type: ".$file_type."\ n";
echo "<br />URL: ".$file_address ."";
}
}
?>

[Schraalhans Keukenmeester]

At Mon, 11 Jun 2007 05:02:40 +0000, Bob let h(is|er) monkeys type:

Hello everyone !!!
I have a very neat script to download files to the server, the problem is
that it uploads all kind of files, txt, exe, zip,
you name it. I have been trying to add some code but still can't get it to
work. What I would like the script to do is only to allow the jpg, jpeg,
bmp, gif files to be downloaded. Can anyone can give me a hand?
Thanks in Advance, Bob.
This is the script. >>>>>>>>>>>>>>> >>>>>>
<form name="upload" enctype="multip art/form-data" method="post" action="">
<input type="file" name="file" />
<br /><input type="submit" name="submit" value="Upload" />

<?php

if(isset($_POST['submit'])) {

$dir = "files/"; //Upload directory
$error = ""; //Setting a false error
$address = "http://".$_SERVER['HTTP_HOST']."/"; //Getting the web address
$file_name = $_FILES['file']['name']; //Getting the file name
$file_type = $_FILES['file']['type']; //Getting the file type
$file_size = "".$_FILES['file']['size']." bytes"; //Getting the file size
$file_tmp = $_FILES['file']['tmp_name']; //Setting the temporary name
$file_address = $address.$dir.$ file_name; //URL of file

if(file_exists( $dir.$file_name )) {
$error = "<br />Error: A file with the same name already exists!";
}

else {
@copy ($file_tmp, $dir.$file_name ) or ($error="<br />Error: File could not
be copied!");
}

if($error != "") {
echo $error;
}

else {
echo "<br />File successfully uploaded!\n";
echo "<br />Name: ".$file_name."\ n";
echo "<br />Size: ".$file_size."\ n";
echo "<br />Type: ".$file_type."\ n";
echo "<br />URL: ".$file_address ."";
}
}
?>

You'll have to test for extension first, and then assert what's sent
actually is what it claims to be. A safe way would be to apply the
appropriate imagecreatefrom (jpg|gif|bmp|pn g) etc functions provided by the
gd library.

There are scripts that 'simply' check exif data, or gif headers and such
to assert valid pictures are sent, but it's not foolproof, in fact it's
quite easy to abuse an image container to send any data to the server.

Additionally, to have some prevention before the form is submitted, a
little javascript could check for the proper extension in the form page.
But you can never rely on that test.

Does that help in any way?
--
Schraalhans Keukenmeester - sc*********@the .Spamtrapexampl e.nl
[Remove the lowercase part of Spamtrap to send me a message]

"strcmp('apples ','oranges') < 0"

[iktorn]

Schraalhans Keukenmeester napisał(a):

At Mon, 11 Jun 2007 05:02:40 +0000, Bob let h(is|er) monkeys type:

>Hello everyone !!!
I have a very neat script to download files to the server, the problem is
that it uploads all kind of files, txt, exe, zip,
you name it. I have been trying to add some code but still can't get it to
work. What I would like the script to do is only to allow the jpg, jpeg,
bmp, gif files to be downloaded. Can anyone can give me a hand?

You'll have to test for extension first, and then assert what's sent
actually is what it claims to be. A safe way would be to apply the
appropriate imagecreatefrom (jpg|gif|bmp|pn g) etc functions provided by the
gd library.

Much better way imho is to use getimagesize
(http://pl2.php.net/manual/en/function.getimagesize.php)
to check if its a valid image file.

Additionally you can check extension of uploaded file.

--
Wiktor Walc
http://phpfreelancer.net

[Schraalhans Keukenmeester]

At Mon, 11 Jun 2007 11:02:56 +0200, iktorn let h(is|er) monkeys type:

Schraalhans Keukenmeester wrote:

>You'll have to test for extension first, and then assert what's sent
actually is what it claims to be. A safe way would be to apply the
appropriate imagecreatefrom (jpg|gif|bmp|pn g) etc functions provided by the
gd library.

Much better way imho is to use getimagesize
(http://pl2.php.net/manual/en/function.getimagesize.php)
to check if its a valid image file.

Additionally you can check extension of uploaded file.

I haven't been able to test if the getimagesize() function can be fooled
easily. If not, it's probably quicker than using imagecreatefrom FORMAT()
and therefor a better choice indeed. Great suggestion, it's the PHP manual
suggested way of checking for valid images I noticed. It doesn't give much
explanation though.
--
Schraalhans Keukenmeester - sc*********@the .Spamtrapexampl e.nl
[Remove the lowercase part of Spamtrap to send me a message]

"strcmp('apples ','oranges') < 0"

[Kenoli]

This link says a bit more about this function:

http://www.phpfreaks.com/phpmanual/p...imagesize.html

This seems to be the key (from that page):

"If accessing the filename image is impossible, or if it isn't a valid
picture, getimagesize() will return FALSE and generate an error of
level E_WARNING."

--Kenoli

On Jun 11, 8:46 am, Schraalhans Keukenmeester
<Schraalh...@th e.spamtrapexamp le.nlwrote:

At Mon, 11 Jun 2007 11:02:56 +0200, iktorn let h(is|er) monkeys type:

Schraalhans Keukenmeester wrote:

You'll have to test for extension first, and then assert what's sent
actually is what it claims to be. A safe way would be to apply the
appropriate imagecreatefrom (jpg|gif|bmp|pn g) etc functions provided by the
gd library.

Much better way imho is to use getimagesize
(http://pl2.php.net/manual/en/function.getimagesize.php)
to check if its a valid image file.

Additionally you can check extension of uploaded file.

I haven't been able to test if the getimagesize() function can be fooled
easily. If not, it's probably quicker than using imagecreatefrom FORMAT()
and therefor a better choice indeed. Great suggestion, it's the PHP manual
suggested way of checking for valid images I noticed. It doesn't give much
explanation though.

--
Schraalhans Keukenmeester - schraalh...@the .Spamtrapexampl e.nl
[Remove the lowercase part of Spamtrap to send me a message]

"strcmp('apples ','oranges') < 0"

[Schraalhans Keukenmeester]

At Mon, 11 Jun 2007 09:24:44 -0700, Kenoli let h(is|er) monkeys type:

This link says a bit more about this function:

http://www.phpfreaks.com/phpmanual/p...imagesize.html

This seems to be the key (from that page):

"If accessing the filename image is impossible, or if it isn't a valid
picture, getimagesize() will return FALSE and generate an error of
level E_WARNING."

--Kenoli

Thanks for the update. I did see that indeed, but I'd hoped there would be
some expansion on what -according to the authors/developers- constitutes
'a valid picture'. I know I can bake a GIF file with no image but having a
valid header according to some scripts at least. Don't know enough about
other popular formats though.

Whether or not a theoretically harmful binary string disguised as an image
could wreak havoc on the server, or -more likely- on other people's pc
after downloading such an 'image' is another matter of course.

[Anze]

Just an info - I have had problems with using GetImageSize on large files
(videos). It was sloooooow (~1s per call). So do be careful.

Do you care if the file is really an image or it contains some other data
too? There is no way to prevent embedding the data in an image against a
skillful hacker.

It is however important that the extension is correct (or someone could
upload for instance .php file and then execute it) and that you can create
a thumbnail from it (getImageFromXX X) if you need to.

Best,

Anze

Kenoli wrote:

This link says a bit more about this function:

http://www.phpfreaks.com/phpmanual/p...imagesize.html

This seems to be the key (from that page):

"If accessing the filename image is impossible, or if it isn't a valid
picture, getimagesize() will return FALSE and generate an error of
level E_WARNING."

--Kenoli

On Jun 11, 8:46 am, Schraalhans Keukenmeester
<Schraalh...@th e.spamtrapexamp le.nlwrote:

>At Mon, 11 Jun 2007 11:02:56 +0200, iktorn let h(is|er) monkeys type:

Schraalhans Keukenmeester wrote:
You'll have to test for extension first, and then assert what's sent
actually is what it claims to be. A safe way would be to apply the
appropriate imagecreatefrom (jpg|gif|bmp|pn g) etc functions provided by
the gd library.

Much better way imho is to use getimagesize
(http://pl2.php.net/manual/en/function.getimagesize.php)
to check if its a valid image file.

Additionally you can check extension of uploaded file.

I haven't been able to test if the getimagesize() function can be fooled
easily. If not, it's probably quicker than using imagecreatefrom FORMAT()
and therefor a better choice indeed. Great suggestion, it's the PHP
manual suggested way of checking for valid images I noticed. It doesn't
give much explanation though.

--
Schraalhans Keukenmeester - schraalh...@the .Spamtrapexampl e.nl
[Remove the lowercase part of Spamtrap to send me a message]

"strcmp('apples ','oranges') < 0"