note 89446 deleted from function.getimagesize by danbrown
| From: | danbrown@php.net | Date: | Sun, 08 Mar 2009 15:59:48 +0000 |
| Subject: | note 89446 deleted from function.getimagesize by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151632@lists.php.net to get a copy of this message | ||
Note Submitter: Charles Hill (degreesofzero.com)
----
You should use a text input field in your form for the user to specify a remote URL for an image
they wish to upload. Then check the image size of the image at the URL (among other security checks
you should run), before you have your server download the remote image to the server.
In response to:
"Note that if you specify a remote file (via a URL) to check the size of, PHP will first
download the remote file to your server.
If you're using this function to check the size of user provided image links, this could
constitute a security risk. A malicious user could potentially link to a very large image file and
cause PHP to download it. I do not know what, if any, file size limits are in place for the
download. But suppose the user provided a link to an image that was several gigabytes in size?
It would be nice if there were a way to limit the size of the download performed by this function.
Hopefully there is already a default with some sensible limits."