Re: Is it possible to test an uploaded file to check the type?
| From: | Gerard Samuel | Date: | Mon, 14 Jul 2003 04:24:03 +0000 |
| Subject: | Re: Is it possible to test an uploaded file to check the type? | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-155039@lists.php.net to get a copy of this message | ||
Gerard Samuel wrote:
Looking for opinions. Can a spoofed uploaded file hurt a script or a webserver?? Reason why Im asking is because, I looked over the magic.mime file on my server, and I see that it doesn't support flash files (I may be wrong), of which I currently allow flash files to be uploaded. So who knows what else it may not support. I guess, can it really be bad for your script, your server, and/or your health??A client-supplied value isn't going to be too useful - it can be spoofed, or may not be present. (I believe a Windows browser would set the mime-type based purely on the file extension, though I haven't tested this myself).Then my apologies. I thought php determined the file type on upload, and not rely on user input as your're saying. Makes me rethink some of my own code :)