V
V
venaf342282020-04-19 12:37:36
PHP
venaf34228, 2020-04-19 12:37:36

Is this method of downloading files safe enough?

Good afternoon!
Is this method secure enough to upload images to the server?
upload.php

<?php
$AllowFileExtension = array(
    'jpg',
    'png',
    'jpeg'
);
$FileExtension      = pathinfo(strtolower($_FILES['file']['name'][0]), PATHINFO_EXTENSION);
if (!in_array($FileExtension, $AllowFileExtension)) {
    die('Разрешенные форматы файла: jpg, jpeg, png.');
}
$TempName = $_FILES['file']['tmp_name'][0];
if (filesize($TempName) > 10485760) {
    die('Размер изображения не должен превышать 10МБ.');
}
$imageinfo = getimagesize($TempName);
if ($imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/png') {
    die('Разрешенные форматы файла: jpg, jpeg, png.');
}
$NewFileName  = (md5(uniqid() . strtolower($_FILES['file']['name'][0]))) . '.' . $FileExtension;
$UploadDir    = "/img/";
$NewFilePatch = $UploadDir . $NewFileName;
if (!is_writable($UploadDir)) {
    die('Каталог недоступен для записи.');
}
$CopyFile = copy($TempName, $NewFilePatch);
if (!$CopyFile) {
    die('Неудалось сохранить файл.');
}
?>

The img folder contains .htaccess with the following content
<FilesMatch "\.(php|cgi|pl|php3|php4|php5|php6|phps|phtml|shtml|py)$">
Order allow,deny
Deny from all
</FilesMatch>

Answer the question

In order to leave comments, you need to log in

2 answer(s)
R
Roman Sarvarov, 2020-04-19
@megakor

You need to check the file extension by its MIME type. Through pathinfo, the check can be removed - it is superfluous.
You need to move a file from tmp through move_uploaded_file(), not through copy().
Bonuses:
1. Use camelCase - don't capitalize your variables (it doesn't look good).
2. Check isset($_FILES['file']['name'][0]) first, otherwise if no file has been loaded, it will return an error (because you refer to an array element that may not exist) .

X
xmoonlight, 2020-04-19
@xmoonlight

If you are expecting a picture - check the properties of the file of the required format. For example, the image resolution before being moved from upload.
Filter (any) - not "banning what I remember", but "allowing what I'm waiting for".

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question