PHP safe upload system

Question

So I have this file upload system that is supposed to only accept the file types in $allowedExts but some guy keeps breaching the system with a file called angel.jpg.php. I think he has changed the mime type but I am still wondering how he breached the extension check. Help would be appreciated. Thanks in advance.

<?php    
$allowedExts = array("gif", "jpeg", "jpg", "png", "bmp", "doc", "pages", "docx",  "pdf","ppt","pptx","xls","xlsx");

$temp = explode(".", $_FILES["file"]["name"]);
$extension = end($temp);
$extension2 = pathinfo($target_file,PATHINFO_EXTENSION);

if (($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/jpg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/x-png")
|| ($_FILES["file"]["type"] == "image/png")
|| ($_FILES["file"]["type"] == "image/bmp")
|| ($_FILES["file"]["type"] == "application/msword")
|| ($_FILES["file"]["type"] == "application/x-iwork-pages-sffpages")
|| ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.wordprocessingml.document")
|| ($_FILES["file"]["type"] == "application/pdf")
|| ($_FILES["file"]["type"] == "application/vnd.ms-powerpoint")
|| ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.presentationml.presentation")
|| ($_FILES["file"]["type"] == "application/excel")
|| ($_FILES["file"]["type"] == "application/vnd.ms-excel")
|| ($_FILES["file"]["type"] == "application/x-excel")
|| ($_FILES["file"]["type"] == "application/x-msexcel")
|| ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
&& in_array($extension, $allowedExts) && in_array($extension2, $allowedExts) && getimagesize($_FILES["file"]["name"])!=='FALSE')
{
// Upload file
}

else {
// Do not upload file
}

Your logic is flawed, because the conditions for the extension are &&-linked to the last of your mime type conditions only, because && has higher precedence than ||. You need to put another set of round brackets around all those ||-linked conditions. — C3roe
– C3roe, Commented Nov 16, 2014 at 12:26
try to minimize the logical conditions by putting the $_FILES["file"]["type"] into a variable — Riad
– Riad, Commented Nov 16, 2014 at 12:28
And combining all those none-image mime types with getimagesize does not make much sense either – I doubt that getimagesize will return anything but false if you let it check f.e. an excel document. — C3roe
– C3roe, Commented Nov 16, 2014 at 12:30
Drop all that and replace it with an array and in_array($realMimeType, $arrayOfAllowedMimeTypes, true) — PeeHaa
– PeeHaa, Commented Nov 16, 2014 at 13:07

Mramaa · Accepted Answer · 2015-01-04 12:59:27Z

2

As nobody added more useful tips.
I decided to search for them myself.
I found some pretty good tips on various websites.

Here are two of them:
http://hungred.com/useful-information/secure-file-upload-check-list-php/
http://nullcandy.com/php-image-upload-security-how-not-to-do-it/

answered Jan 4, 2015 at 12:59

Mramaa

3902 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP safe upload system

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related