Hi,
The type given via $_FILES['file']['type'] is not safe. That is the type
that comes from the headers, which are defined by the browser. But a
hacker can make a custom request, which defines another type like
image/png for a PHP file, which can be very unsafe. You should always
check if the content is what the headers and the extension say they are.
---
Regards,
Pieter Kokx
MaakSite.net
PHP Developer
Dietrich Bollmann schreef:
Hi,
...answering to my own question for the case anybody with a similar
problem finds it some time later...
On Thu, 2008-06-12 at 14:44 +0900, Dietrich Bollmann wrote:
When uploading a file via the <input type="file" ...> tag the value
of $_FILES['file']['type'] is retrieved (application/octet-stream in
the case of a simple text file), stored in the database and later
reused when somebody tries to download the file to set the
'content-type' header
The value of $_FILES['file']['type'] which is set when the file is
uploaded, seems not to be the mime type.
The PEAR Package "MIME_Type" ( http://pear.php.net/package/MIME_Type/ )
can be used with better results for detecting the mime type directly
from the file:
<?php
require_once 'MIME/Type.php';
$filename = '/path/to/some/file.jpg';
echo MIME_Type::autoDetect($filename);
?>
See the documentation here:
http://pear.php.net/manual/en/package.tools.mime-type.detecting.php
Dietrich
