Re: Protector protects from a legitimate upload.

List posts in the topic

Re: Protector protects from a legitimate upload.

msg# 1.5.1

depth:

2

Previous post - Next post | Parent - No child | Posted on 2007/9/5 12:34 | Last modified

GIJOE    Posts: 4110

When I had read the class of media uploader in the core from xoops.org 1~2 years ago, it didnot look well-designed.

Checking MIME is non-sense at all.
It's just a member of user's post.

Even image files you have to check their contents.
(by getimagesize() etc.)

There is a major and bad browser named "Microsoft Internet Explorer".
Since the idiot browser ignores the header of "Content-Type", storing HTML as gif makes XSS.

Of course, attackers can post HTML file as ".gif" and "image/gif".

Votes:17 Average:10.00

Posts tree

• Protector protects from a legitimate upload. (vaughan, 2007/8/27 0:46)
  • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/28 12:35)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 3:48)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:51)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/8/29 4:30)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/29 5:32)
    • Re: Protector protects from a legitimate upload. (vaughan, 2007/8/29 8:44)
      • Re: Protector protects from a legitimate upload. (GIJOE, 2007/8/31 4:30)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/1 4:15)
  • Re: Protector protects from a legitimate upload. (Dave_L, 2007/9/4 17:59)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/5 12:34)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/4 20:11)
  • Re: Protector protects from a legitimate upload. (suico, 2007/9/6 2:44)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/6 4:03)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/21 3:41)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/22 17:34)
  • Re: Protector protects from a legitimate upload. (vaughan, 2007/9/28 1:38)
    • Re: Protector protects from a legitimate upload. (GIJOE, 2007/9/28 3:09)