note 66377 deleted from features.file-upload by danbrown

Note Submitter: ivan DOT cukic AT gmail DOT com ---- There was a post earlier about not using the $_FILES['userfile']['type'] for verification and that a malicious PHP file could be hidden under the image/gif mime type. That is correct, but it is not enough just to use getImageSize() or exif_imagetype() because php code can be hidden in the comment part of the picture. The only way you can be sure it will not be executed is to make sure that the extension is not recognized by the server as a php script. If you want a proof of concept, open The GIMP and create a 10x10px blank GIF image. When saving, just enter <? phpinfo() ?> as GIF comment. Rename the saved file from something.gif into the something.php and ask the server for it. (And make sure that you NEVER call include() with a file that was uploaded)