Re: Protector protects from a legitimate upload.

List posts in the topic

Re: Protector protects from a legitimate upload.

msg# 1.3.2.1

depth:

3

Previous post - Next post | Parent - No child | Posted on 2007/8/31 4:30

GIJOE    Posts: 4110

Quote:

vaughan wrotes:
the submit form uses $_FILES['userfile']['name'] & $_FILES['userfile']['type']

You should know $_FILES[]['type'] has non-sense at all.

And if you dare to use $_FILES[]['name'], filter it by white list like
preg_replace( '/[^0-9a-zA-Z_-]/' , '' , $_FILES[]['name'] ) ;

And its extension should be set by file contents (check by getimagesize()).

If the file is not a image, don't place it under DocumentRoot.

Votes:1 Average:10.00

Posts tree

• Protector protects from a legitimate upload. (vaughan, 2007/8/27 0:46)
  • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/28 12:35)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 3:48)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:51)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/8/29 4:30)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:32)
    • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 8:44)
      • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/31 4:30)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/1 4:15)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/9/4 17:59)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/5 12:34)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/4 20:11)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/6 2:44)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/6 4:03)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/21 3:41)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/22 17:34)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/28 1:38)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/28 3:09)