note 18992 deleted from features.file-upload by philip
| From: | philip@php.net | Date: | Sat, 18 Jan 2003 08:37:40 +0000 |
| Subject: | note 18992 deleted from features.file-upload by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-42335@lists.php.net to get a copy of this message | ||
Well so far none of the suggestions mentioned here has worked for me. I am currently using the
following pieced together from all the different comments and continue to get an "attack"
error. The file I am unloading is 4Bytes and I have the MAX-SIZE set to 100000. Here is the code:
<?
print "$userfile = userfile<br>";
print "$userfile_name = userfile_name<br>";
print "$userfile_type = userfile_type<br>";
print "$userfile_size = userfile_size<br>";
print "$tmp_name = tmp_name<br>";
// In PHP 4.1.0 or later, $_FILES should be used instead of $HTTP_POST_FILES.
if (is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {
copy($HTTP_POST_FILES['userfile']['tmp_name'],
"f:\\place\\to\\file\\");
} else {
echo "Possible file upload attack: filename
'".$HTTP_POST_FILES['userfile']['name'].".";
}
/* ...or... */
move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'],
"f:\\place\\to\\file\\");
?>
Here is the result:
= userfile
test.txt = userfile_name
text/plain = userfile_type
= userfile_size
= tmp_name
Possible file upload attack: filename 'test.txt.