image/tiff upload problems

[Anon]

I have searched quite extensively and cannot find a solution to my problem.

I have a file upload script which checks the file type to make sure that the file being uploaded is an image, a word doc, or an excel spreadsheet.

<-- Code Snippet -->
$allowed_types = array("image/bmp","image/tiff","image/gif","image/pjpeg","text/plain","image/jpeg","application/msword","application/vnd.ms-excel");

if (!in_array($the_file_type,$allowed_types)) {
$error .= "File type $the_file_type not allowed.";
return $error;
}

<-- End code snippet -->

I got a lot of this code from one of the articles posted here on file uploads.

The problem I am having is that when I upload a tif image, the server seems to think that I am uploading application/octet-stream. I found this out with some simple debug code.

Is this a function of my web browser not sending the correct mime type with the file, or is it the web server not getting the correct mime type for the file?

Browser: IE 5.5
Web Server: Apache 1.3.12 on Turbolinux Server 6

TIA

[brandonschnell]

the web browser does a POST to the remote server during a file upload and sends the mime/type to the web server. check the mime type you've got set for tif images on your computer.

the better solution is to look for specific file extensions rather than rely on the mime type. that way you're not relying on the remote computer to be configured properly.

[Anon]

But if I just check for file extensions, that would allow the remote user to upload anything they want. All the file will need is a valid extension.

Isn't this a security hole?

[brandonschnell]

the same is true in just checking the mime types. the clients browser sets the mime type, so the user could sent just about anything. its up to your web site to be sure the uploaded programs cannot be run on your server. if the file has an image extension it reduces the possiblity of someone uploading a virus in an .exe (or .vbs, .bat, .com, .dll, .ocx, etc...) file and letting other users (mainly windows users) download that file.

now if you check only the file extensions you might cause problems for mac users who can blissfully name their image files anything they want. so notify the user what file extensions/types are accepted and only allow certain characters in the file name [a-z0-9_()-~.]

[Anon]

Very true.

Thanks for the input. I am sure I will come to some kind of middle ground.