Re: Re: Security Concerns with Uploaded Images:

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



At 9:45 AM +0100 5/23/06, Rory Browne wrote:
Use the unix command "file" to determiner what file you have.
I have had the same problem...


Don't depend on it.

graphic.php

GIF89
<?php do_bad_stuff(); ?>
ANY_GIF_FOOTERS_HERE

should according to file be a gif, but contains embedded php.

Rory:

I'm not disagreeing with you, but how would that work? The file would still have a suffix of ".gif" and as such wouldn't be recognized as code to execute.

For example, I can place php code within a html document and it will not run because the document has a ".html" suffix -- unless I indicate such in my .htaccess.

So, how does placing <?php do_bad_stuff(); ?> within any image cause problems?

However, if the problem is real, then why not just resample or alter the image in some fashion? Surely, that would cause any embedded code to not run properly, right?

Thanks.

tedd
--
------------------------------------------------------------------------------------
http://sperling.com  http://ancientstones.com  http://earthstones.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux