Re: cvs: phpdoc /en/reference/filesystem/functions is-uploaded-file.xml

anatoly techtonik wrote: > Hmm.. Is it possible to forge $_FILES contents by supplying some wrong > POST data? Derick says it's possible: >> is_uploaded_file is a register_globals artifact, and shouldn't need to >> be used with the $_FILES array. > ? That is untrue. You should always use it. I can't read PHP source code well but I can see this: > rfc1867.c:1036: zend_hash_add(SG(rfc1867_uploaded_files), temp_filename, strlen(temp_filename) > + 1, &temp_filename, sizeof(char *), NULL); temp_filename is added to SG(rfc1867_uploaded_files) > rfc1867.c:1186: register_http_post_files_variable(lbuf, temp_filename, http_post_files, 1 > TSRMLS_CC); temp_filename is added also to http_post_files > basic_functions.c:3013: if (zend_hash_exists(SG(rfc1867_uploaded_files), Z_STRVAL_PP(path), > Z_STRLEN_PP(path)+1)) { is_uploaded_file() checks the file against SG(rfc1867_uploaded_files) From these 3 facts I conclude that is_uploaded_file() returns true exactly for files which are in http_post_files. As I said - I can't read PHP source well so maybe I overlooked something. Derick, can you please explain why it is necessary to always use is_uploaded_file()? Jakub Vrana