RE: [PHP-WIN] Re: File Upload - extension filtering
| From: | George Pitcher | Date: | Tue, 26 Nov 2002 16:44:19 +0000 |
| Subject: | RE: [PHP-WIN] Re: File Upload - extension filtering | ||
| References: | 1 | Groups: | php.windows |
| Request: | Send a blank email to php-windows+get-17147@lists.php.net to get a copy of this message | ||
Brian,
Possibly so, but I have a small number of authenticated users who are
unlikely to do anything malicious.
Cheers
George
> -----Original Message-----
> From: Brian McGarvie [mailto:brian.mcgarvie@anypurposeloans.co.uk]
> Sent: 26 November 2002 4:34 pm
> To: php-windows@lists.php.net
> Subject: Re: [PHP-WIN] Re: File Upload - extension filtering
>
>
> using the mime-type is safer ;)
>
> "George Pitcher" <george.pitcher@ingenta.com> wrote in message
> news:HHEIKBOENJPJNLHFCCCCIEIECBAA.george.pitcher@ingenta.com...
> > Brian,
> >
> > Thanks. However, I have just solved it by using stristr() instead.
> >
> > Works a treat.
> >
> > George
> >
> > > -----Original Message-----
> > > From: Brian McGarvie [mailto:brian.mcgarvie@anypurposeloans.co.uk]
> > > Sent: 26 November 2002 4:26 pm
> > > To: php-windows@lists.php.net
> > > Subject: [PHP-WIN] Re: File Upload - extension filtering
> > >
> > >
> > > use 'image/tiff' instead...
> > >
> > > "George Pitcher" <george.pitcher@ingenta.com> wrote in message
> > >
> > > news:HHEIKBOENJPJNLHFCCCCIEIDCBAA.george.pitcher@ingenta.com...
> > > > Hi all,
> > > >
> > > > I have file upload working on my NT/Lasso/PHP site and want to
> restrict
> > > the
> > > > type of file being uploaded to either PDF, TIF or ZIP.
> > > >
> > > >
> > > > My code sofar is:
> > > >
> > > > <?
> > > > $u_ext = "error";
> > > > $location
> > > > ="http://mysite/upload_confirm.lasso?nj=" . $nj;
> > > > $file_dir="e:\\upload\\";
> > > > foreach($HTTP_POST_FILES as $file_name => $file_array){
> > > > if($file_array['type']=="application/octet-stream"){
> > > > $u_ext = ".tif";
> > > > }
> > > > if($file_array['type']=="application/pdf"){
> > > > $u_ext = ".pdf";
> > > > }
> > > > if($file_array['type']=="application/x-zip-compressed"){
> > > > $u_ext = ".zip";
> > > > }
> > > > if($u_ext=="error"){
> > > > die( "<h1>You have tried to upload a file that is not
> 'pdf', 'zip' or
> > > > 'tif'. Please go back and try again.</h1>\n");
> > > > }
> > > > if(is_uploaded_file($file_array['tmp_name'])){
> > > > move_uploaded_file($file_array['tmp_name'],
> > > > "$file_dir/$nj".$u_ext)
> > > > or die ("Sorry, unable to upload the file at this time - please
> > > try again
> > > > later.");
> > > > header("Location: $location");
> > > > }
> > > > }
> > > > ?>
> > > >
> > > > Although the above script works, octet-stream covers more than just
> tif
> > > > files.
> > > > Any clues?
> > > >
> > > > Cheers
> > > >
> > > > George
> > > >
> > > > ===
> > > >
> > > > George Pitcher
> > > > HERON Technical Manager
> > > > Ingenta plc
> > > > 23-38 Hythe Bridge Street, Oxford, OX1 2ET
> > > > T +44 (0)1865 799137 direct
> > > > T +44 (0)1865 799000 switchboard
> > > > F +44 (0)1865 799134
> > > > E george.pitcher@ingenta.com
> > > >
> > > > www.ingenta.com
> > > > Ingenta: Empowering the exchange of academic and
> professional content
> > > > online.
> > > >
> > >
> > >
> > >
> > > --
> > > PHP Windows Mailing List (http://www.php.net/)
> > > To unsubscribe, visit: http://www.php.net/unsub.php
> > >
> > >
>
>
>
> --
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>