Sebastian wrote:
i have an upload form which i would only like to allow compressed zip
files
and rar files to be uploaded. currently i use
if ($_FILES['userfile']['type'] != 'application/x-zip-compressed')
which only seems to work in IE, doesn't work in mozila (haven't tried
others) what the best way to detect if its a rar or zip file which works
in
a better range of browsers? someone gave me a suggestion to check if the
file ends in .rar or .zip but that isn't very secure since anyone would be
able to append it to the filename regardless of the actual file type.
The 'type' in $_FILES is just some made-up bull[bleep] from the browser
manufacturer.
In other words, like everything else made by the browser manufacturers,
it's *NOT* standard, it's *NOT* reliable, and it has absolutely *NO*
usefulness from a security stand-point :-)
What you need to do is store the uploaded file somewhere as inaccessible
as possible, so that only PHP can find/read it.
Then, you need to authenticate that file as much as you possibly can,
using every reasonable means at your fingertips.
For your case, the zip file, this should include:
Does it look like a zip file to the 'file' command in Linux?
Can you unzip it without errors?
Does it pass consistency checks of the zip program?
Can gunzip, if that supports unzip with a different code-base/algorithm,
also unzip it, and consistency check it.
Does it have a reasonable size?
If you have an expectation of specific kinds of files within the zip, you
should also walk through each of those files and authenticate them, again,
as much as you can.
Can image files have http://php.net/getimagesize called on them successfully?
Does it pass the Unix 'file' test?
Does the mime-type from getimagesize match the extension?
Can ImageMagik 'convert' the file without error?
ImageMagik may have a consistency check option. Use it.
For text files, does it pass the Unix 'file' test?
Do the contents have a reasonable distribution of characters in English? :-)
Are the about the right number of newlines for a file of that size?
Is the size reasonable in the first place?
You may not be able to implement all these tests -- But the more you can
implement, and, more importantly, if you set it up to make it easy to ADD
more tests later, the better off you are.
Only files that pass your tests with flying colors then get moved to their
ultimate destination.
--
Like Music?
http://l-i-e.com/artists.htm
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
