IE using PHP and not depending on system commands? thanks for your insight so far, very important.
Richard Lynch wrote:
//The mime type of the file, if the browser provided this information.
$userfile_type=$_FILES['userfile']['type'];
Nooooooooooooooo!
First of all, the browsers do *NOT* provide any kind of standardized MIME types.
One will call it text/x-csv, the other text/csv, the other text/plain, ...
Furthermore, you should *NOT* rely on this data coming from the browser.
Any body with HALF A CLUE can forge a POST with *any* kind of type they want, shoving a trojan shell script into your script with a type of plain/x-csv
Now you're probably not gonna be silly enough to just go and exec() that script, but what if they manage to find *another* user on your server who does just that?
Whammo! You no longer own your server, they do.
Assume the file you are getting is hostile.
Use the Unix "file" command to analyze it.
Then use your own script to analyze it, and be sure it contains suitable data.
--
Angelo Zanetti Z Logic [c] +27 72 441 3355 [t] +27 21 464 1363 [f] +27 21 464 1371 www.zlogic.co.za
-- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
