note 18992 added to features.file-upload
| From: | seed_ling at yahoo dot com | Date: | Tue, 12 Feb 2002 21:55:25 +0000 |
| Subject: | note 18992 added to features.file-upload | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-26525@lists.php.net to get a copy of this message | ||
Well so far none of the suggestions mentioned here has worked for me. I am currently using the
following pieced together from all the different comments and continue to get an "attack"
error. The file I am unloading is 4Bytes and I have the MAX-SIZE set to 100000. Here is the code:
<?
print "$userfile = userfile<br>";
print "$userfile_name = userfile_name<br>";
print "$userfile_type = userfile_type<br>";
print "$userfile_size = userfile_size<br>";
print "$tmp_name = tmp_name<br>";
// In PHP 4.1.0 or later, $_FILES should be used instead of $HTTP_POST_FILES.
if (is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {
copy($HTTP_POST_FILES['userfile']['tmp_name'],
"f:\\place\\to\\file\\");
} else {
echo "Possible file upload attack: filename
'".$HTTP_POST_FILES['userfile']['name'].".";
}
/* ...or... */
move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'],
"f:\\place\\to\\file\\");
?>
Here is the result:
= userfile
test.txt = userfile_name
text/plain = userfile_type
= userfile_size
= tmp_name
Possible file upload attack: filename 'test.txt.
--
http://www.php.net/manual/en/features.file-upload.php
http://master.php.net/manage/user-notes.php?action=edit+18992
http://master.php.net/manage/user-notes.php?action=delete+18992
http://master.php.net/manage/user-notes.php?action=reject+18992