php file upload type

Question

I'm trying to upload a zip file and a csv file from HTML form.

On PHP, When I printed $_FILES (Actually $request->getFiles() in symfony), I got following.

Array
(
    [zipfile] => Array
        (
            [name] => tempfiles.zip
            [type] => application/octet-stream
            [tmp_name] => C:\wamp\tmp\php5D42.tmp
            [error] => 0
            [size] => 850953
        )
    [csvfile] => Array
        (
            [name] => test.csv
            [type] => application/vnd.ms-excel
            [tmp_name] => C:\wamp\tmp\php5D52.tmp
            [error] => 0
            [size] => 312
        )
)

I'm wondering with the type and tmp_name. I need to take few decisions based on type. Is it safe to take decisions on existing type? Will I get same result for similar files on Linux server?

Again tmp_name have .tmp extension. Is it consistent on both windows/linux? If not, is there any way that the code I write on windows (decision using type) will work on linux without any issue?

@deceze Sorry but not related. Although I thank you for the good link. I'll definitely go through them in details but my current code code is for admin panel of my site. Thus I'm more concerned about functionality rather than security. Security/best practice is not a question here but making sure it work on both windows/linux. — Kapil Sharma
– Kapil Sharma, Commented Sep 25, 2012 at 9:48

StaticVariable · Accepted Answer · 2012-09-25 09:47:34Z

3

Using this type can be dangerous Because user can change the type of the files and can upload a php script.

You should validate the type first just like get_image_size() to validate a image file.I have no idea about .zip file

answered Sep 25, 2012 at 9:47

StaticVariable

5,2934 gold badges26 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Kapil Sharma Over a year ago

Thanks for the hint. If image should be tested through get_image_size, zip file can be tested through zip_open().

xdazz · Accepted Answer · 2012-09-25 09:42:57Z

2

It is not safe to trust the type form $_FILES, you need to validate the file type in server side.

For .tmp extension, it is ok both on windows or linux.

answered Sep 25, 2012 at 9:42

xdazz

161k38 gold badges255 silver badges278 bronze badges

2 Comments

deceze Over a year ago

The tmp_name is not guaranteed to end in .tmp on every system.

xdazz Over a year ago

@deceze That's true, no matter the extension is, it won't be the problem, anyway, the extension name should not be hardcoded.

Collectives™ on Stack Overflow

php file upload type

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related