Proposals for HTTP_Upload

Dear HTTP_Upload users and maintainers, I would like to propose the integration of a mime type check which is - as far as I have seen - not yet part of the package. This could be done in a similar way to setValidExtensions()/_evalValidExtensions() and that it is only checked if values are supplied by the user. I think checking the mime type of an uploaded file is more secure than just checking the extension of the file name. Unfortunately I'm not yet familiar with CVS but would still like to contribute and offer writing the required code, test it with the current release and then send it to the maintainer. Two more suggestion: 1) Maybe strtolower() should be added to lines 667 and 672 when checking the file extension because the in_array check is case-sensitive and should not be in this case: if (in_array(strtolower($this->getProp('ext')), $exts)) { and if (!in_array(strtolower($this->getProp('ext')), $exts)) { Maybe Thomas can do this - should be a quick fix. 2) Another thing is the chmod() on line 580. Maybe this could be made more adaptable via a setFileMode() method and an associative array with the respective values for user, group and all. Because with the current parameter '0660' uploaded files cannot be accessed publicly. Again, I would write the code and send it to Thomas. Any interest or ideas about this? Thanks in advance, Torsten Roehr