Re: Re: Security Concerns with Uploaded Images:
| From: | tedd | Date: | Tue, 23 May 2006 14:52:43 +0000 |
| Subject: | Re: Re: Security Concerns with Uploaded Images: | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-236722@lists.php.net to get a copy of this message | ||
At 9:45 AM +0100 5/23/06, Rory Browne wrote:
Rory: I'm not disagreeing with you, but how would that work? The file would still have a suffix of ".gif" and as such wouldn't be recognized as code to execute. For example, I can place php code within a html document and it will not run because the document has a ".html" suffix -- unless I indicate such in my .htaccess. So, how does placing <?php do_bad_stuff(); ?> within any image cause problems? However, if the problem is real, then why not just resample or alter the image in some fashion? Surely, that would cause any embedded code to not run properly, right? Thanks. tedd -- ------------------------------------------------------------------------------------ http://sperling.com http://ancientstones.com http://earthstones.comUse the unix command "file" to determiner what file you have. I have had the same problem...Don't depend on it. graphic.php GIF89 <?php do_bad_stuff(); ?> ANY_GIF_FOOTERS_HERE should according to file be a gif, but contains embedded php.