Serious Security Concern using fopen()

NoFear

When using fopen() in your php script, if the file you're opening is on a user's machine a security concern in terms of a virus or other malicious content?

For example, I am creating a site that allows a user to designate their own images from their hard drive to be displayed while they are surfing, and I want to use fopen() to validate that the file is actually there, or display a message that says they need to use a file that exists. However, I need to know if this presents problems in terms of a virus infecting the server by using fopen() to determine if a file exists.

Thanks

diego25

First of all, you can't use fopen to check for files in the USER's machine...You are just not allowed to poke around the user's machine - it's invasion of privacy.

Diego

NoFear

Originally posted by diego25
First of all, you can't use fopen to check for files in the USER's machine...You are just not allowed to poke around the user's machine - it's invasion of privacy.

Diego

Please note that this is NOT what I am doing. This is a user-defined directory where images are loaded at their own free will via an input form that THEY complete. There is no snooping involved. An image CAN be loaded from the users hard drive into the resulting web page.

However, my question was to whether this is a security risk from the server's standpoint when trying to validate that the image is acutally there (in terms of a virus or other malicious code). I COULD simply try to display the image without validating it, and if the image isn't there, the user gets gets the "red x", though I'd rather be more professional than that and try to validate that the image is there, but not at the risk of compromising the server.

I understand the concern for privacy, and my intentions are for the funcationality and usability of my web site - and I wouldn't in any way try to compromise the privacy of my users. Everything is very open and optional in regards to the display of their personal files on the web site - and I have no way to probe their hard drive for information - everything is coming straight from them. My only intention is to validate the existence before displaying it for a professional feel.

dreardon

well, other than not being able to open files on users machine; there is a function you could use instead of fopen if you are just checking that the file exists on the server.

file_exists("filename")
http://www.php.net/manual/en/function.file-exists.php


if(file_exists("yrfile.txt"))
{
     //use yrfile.txt
}
else
{
     print "cannot find file.\n";
}

if you are having a user upload a file, you just need html for a file upload. and perhaps use php to check that the file was uploaded successfully before your next php scripts try using the file on the server.

diego25

Sorry for misunderstanding 🙂

Are you saying that the images will be like

<img src="c:/my documents/pics/img.jpg">
? And you'd like to check if c:/my documents/pics/img.jpg exists?

Or are you saying that the user will upload the image to your server and your image tag will reference your own server?

Diego

dreardon

i believe he is saying that he is creating user directories on the server where users can upload files they want to use for personalization of web pages and wants to use php to validate the file exists on the SERVER in their USER directory before trying to load an image that doesnt exist.

hopefully i am understanding this correctly...

diego25

But

An image CAN be loaded from the users hard drive into the resulting web page

that sentence made me think that he is doing this:
<img src="c:/my documents/pics/img.jpg">
and wants to check the existence of that file...

Duegi

NoFear

Originally posted by diego25
Sorry for misunderstanding 🙂

Are you saying that the images will be like

<img src="c:/my documents/pics/img.jpg">
? And you'd like to check if c:/my documents/pics/img.jpg exists?

Or are you saying that the user will upload the image to your server and your image tag will reference your own server?

Diego

I am saying the first. from a posted form the user will have a temporary variable pointed to an image on their hard drive such as:

Except it will be more something like

echo "<img src=".$picturelocationvariable.">";

However, I will ALSO (though not the topic of this thread) be creating new user directory's based on their user id for storing temporary images for helping to validate login in terms of a random picture generator (ie - "please type in the security code that you see in the picture in the text box below"). This will be server-side only.

I haven't looked into it yet, so it might be very simple, but if somebody knows how to create a new sub-directory with PHP, if you would like to post it, that would be cool. Otherwise I'll be looking into that in the near future.

However, my initial question still remains: Is it a risk for the server to validate the existence of an image from a user's hard drive?

dreardon

ok now he is confusing me too...lost ya on that last one. but regardless, use file_exists to check if a file exists on the SERVER side. you cannot check that a file exists on the client side, as far as i know, with php or any other web language because of security issues.

http://www.php.net/manual/en/function.file-exists.php

if you are indeed trying to validate the existance of an image that exists on the clients local machine, you CANT. they would have to upload their image to your server and then you could check that the image is where it should be on your server.

<

NoFear

ok
thank you
I knew you couldn't check using file_exists(), but I thought you might be able to with fopen(), though now that I think about it, it's still checking the directory the same way that file_exists() is (if using C:\directory..., it's still checking to see if the file exists in that directory on the SERVER).