note 71459 rejected from features.file-upload by dmytton
| From: | dmytton@php.net | Date: | Tue, 06 Feb 2007 11:36:14 +0000 |
| Subject: | note 71459 rejected from features.file-upload by dmytton | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-122915@lists.php.net to get a copy of this message | ||
Note Submitter: frustrated dot user at fake dot com
----
* Please ignore my earlier comments about FAT32 -that wasn't the problem. *
I decided to read about and consider every possible function (and read *all* notes on each) before
calling it quits on FAT32. Apparently the reason for the errors is because I have to use
*double-backslashes* on Windows. It confused me because you use forward slashes to access a file
through the webserver generally (I am new to PHP and web programming).
Also, in one note somewhere, I think someone wrote that you can either use forward slashes or
double-backslashes. You really must use the *double-backslashes* (to escape the backslash you want
to literally use). So, if you are loading the path into a variable, you only need to use
*eregi_replace()* to change all '/' to '\\'.
You don't even need to hard-code the path *if your script resides in the same directory or a
directory above the target directory*...you only need to hardcode the relative path, which is safer,
because you can get the rest with *dirname($_SERVER['SCRIPT_FILENAME'])*.
This is my script without any testing of user data (except filetype), and no testing yet for if the
filename already exists. This is just to get things working.
In 2 places I used error-suppression with @-sign, all my "handleErrors()" function does is
nicely format the actual error messages, because only my eyes are seeing the website now.
<?php
/* SET SOME VARIABLES INDEPENDENT OF UPLOAD RESULTS FOR USE LATER */
$relDir = '/articles/';
$currentPath = dirname($_SERVER['SCRIPT_FILENAME']);
$targetDir = $currentPath . $relDir;
/* TEST FOR UPLOAD STATUS AND DISPLAY ERRORS IF NECCESSARY */
if (!isset($_FILES['newfile']['name'])) {
echo "<p><strong>Problem</strong>: you failed to upload a
file.</p>\n";
exit;
}
else {
if ($_FILES['newfile']['error'] = 0) {
echo "<p>No error was returned.</p>\n";
}
$upFileName = $_FILES['newfile']['name'];
echo "<p><strong>Filename</strong>: \"$upFileName\"
</p>\n";
}
/* CHECK FOR CORRECT FILETYPE */
if ($_FILES['newfile']['type'] != 'text/html') {
echo "<p><strong>Problem</strong>: file is not HTML.</p>\n";
exit;
}
/* MAKE A PERMANENT COPY OF THE FILE BEFORE THE TEMPORARY COPY IS DELETED */
/* Will run if resource truly is an uploaded file */
if (is_uploaded_file($_FILES['newfile']['tmp_name'])) {
echo "<p>File is valid and was uploaded.</p>\n";
$permFile = $targetDir . $upFileName;
$newPermFile = eregi_replace('/', '\\', $permFile);
if (!($content = @ file_get_contents($_FILES['newfile']['tmp_name']))) {
handleErrors();
}
else {
if (!($result = @ file_put_contents($newPermFile, $content))) handleErrors();
else echo "<p><strong>Result of operation:</strong> $result bytes
written.</p>\n";
}
}
/* Will run if resource is NOT a file, maybe this is an attack */
else {
echo '<p><strong>Problem! Possible file upload attack!</strong> Filename:
';
echo $_FILES['newfile']['name'] . "</p>\n";
exit;
}
require_once('footer.html');
?>