verify images (JPG, GIF, PNG) HOW TO

m-dance

Hello All!

I need to verify images have been uploaded by users. It's necessary 'cause
bad guys often uploaded shell script or smth like 😉

Now i'm looking for valid signatute for PNG.

Here is my try for GIF/JPEG:

    case "gif":

substr($fcont, 0, 3) == "GIF"
...
case "jpeg":
case "jpg":
substr($fcont, 0, 10) == "\xFF\xD8\xFF\xE0\x00\x10JFIF"

Vadim

m-dance

Are you kidding? 8) The verify file's extention is not big deal. I've spoken about

file's contents of course.

scoppc

well, to restrict files to only image, you could just utilize $_FILES['name']['type']. It is easier.
Will your way of checking the content be so much secure than this? I really would like to know bout this coz I guess everyone do concern about this matter.

m-dance

It's good enough to prevent uploaded files from executing by shell

m-dance

Add-on: $_FILES doesn't check consistents too. Be careful =)

scoppc

By using is_uploaded_file() function, and then checking the type, the size, dont you think it is secure enuf? or you are discussing another side of security issue that I dunno here?

May be I just dont really expect the unexpected, huh?! 🙂
I'll be glad if you could clearly describe how could someone upload shell script and bypass "my way of checking".

Thanks in advance.

superwormy

You can check the file extension first, which should get rid of most security issues, then you can check $_FILES['userfile']['type'], which gives the mime-type of the file... but not that that is supplied by the client... so its still not secure.

Your best bet might be to put the files somewhere a user cannot directly execute them, ie outside the www directory or inside a password protected directory.

scoppc

I really dont think that by checking the extension, you can get rid of many security issues.
I can display an image on my website without even need to specify any extensions to the filename. "logo" and "logo.gif" will show you the logo!

I can just upload some file without any extension or a fake one.

superwormy

Lots of cases can be eliminated by the file extension, I didn't say it was foolproof though.

Apache won't execute a PHP script without a .php extension ( unless you changed the config on your server, which is possible ), Perl won't be executed unless it's .cgi or *.pl ( again, unless you changed it ) and there are lots of other cases as well.

If its that much of a concern, I gave you two other suggestions, one put files outside the web directory, two password protect the directory.

superwormy

You might also try the file command at a Unix shell prompt... not sure if theres a native PHP equivalent...

get_image_size() will let you know the type for IMAGE files...

scoppc

Well, uploading to password protected folder or outside web directory is good idea.
But, can you use it directly? I mean, if I am developing an application where member can upload her photo and right after that, display it to her. Can it be done if I store the file in a folder outside web directory?
Sorry if this question sounds so stupid coz I have no idea on this at all.

Originally posted by m-dance
Add-on: $_FILES doesn't check consistents too. Be careful =)

What does this mean? and the shell stuff, can u explain that?

superwormy

I have no idea what m-dance said about '$_FILES not checking consistents', that doesn't sound like good english to me...

At a *nix shell prompt, type:

file TheNameOfYourFile.php

For PHP it says... PHP script text

Of course you can use it immediately, you'll just need to use readfile() and header() or fopen(), fpassthru() or something along those lines to read the file in spit it out to the user.

m-dance

Originally posted by superwormy
I have no idea what m-dance said about '$_FILES not checking consistents', that doesn't sound like good english to me...

ok, ok 😉)

You can perform very simple test - modify header (e.g. "GIF89a" to "FIG66b") and then upload that file. But extention of cource must be .gif. What do you think, what will be in $FILES[]['type'] ? 😉

Well, you can easily modify header to
"#!/bin/sh" isn't? =)

superwormy

Originally posted by m-dance
ok, ok 😉)

You can perform very simple test - modify header (e.g. "GIF89a" to "FIG66b") and then upload that file. But extention of cource must be .gif. What do you think, what will be in $FILES[]['type'] ? 😉

Well, you can easily modify header to
"#!/bin/sh" isn't? =)

... What??? ...

m-dance

Do you perform already? =))