Re: Strategy for Secure File Storage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Kevin Murphy wrote:
> $ext = explode(".",$file);
> 
> $extension = $mimetypes["$ext[1]"];

Other people have provided answers so I'll just make a quick comment on
this bit.

It's not ideal but if you only upload a subset of file types then I
guess it's OK.

Also if the file has more than a single "dot" in it (e.g. my.image.jpg)
which is perfectly valid, then $ext[1] will contain ("image") which
isn't right.

If possible use e.g.
http://www.php.net/manual/en/function.mime-content-type.php or Example
606 here http://www.php.net/manual/en/function.finfo-file.php but these
may not be available on your PHP install.

You should probably check more thoroughly:

e.g.

$mimetype = 'application/octet-stream'; // default
$ext = array_pop($dummy = explode('.', $file));
if (!empty($mimetypes[$ext]))
  $mimetype = $mimetypes[$ext];

or something similar.... (not tested above!)


Hope this helps ya.

Col

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux