hi there , i was wondering on security of file uploads , i am currently
using the pear uploader class , i can check for allowed file extensions ,
but it doesnt seem to check for file type , i can currently rename say an
image to zip and it uploads , is there anyway a hacker could rename an
executable to a zip and able to upload it and execute it ?
I can't address your specific question but here are a couple of recommendations:
-Rename the uploaded file so that the user won't know what it's called on the server.
-Store the file outside of the Web directory so it's not accessible via HTTP.
Hope that helps,
Larry