Re: JPEG Upload
| From: | Sanford Whiteman | Date: | Sun, 06 May 2012 04:13:45 +0000 |
| Subject: | Re: JPEG Upload | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-60488@lists.php.net to get a copy of this message | ||
> Or find a way to have (some of) your users have some level of trust.
Or don't execute anyone's uploads.
If you allow people to upload code, make them say it's code (via
extension *and* by putting it in an executable area).
It is not difficult to predict whether a file will be processed by PHP
before worrying about what PHP would do with it.
If people really worried as much as they claim to about execution of
any old document, robots, htaccess, ds_stores -- and php.inis, for
that matter -- would be considered highly dangerous.
-- S.