Prevent Upload If File is 0kb?

[bbeban]

Hi,

Just wondering if anyone out there can tell me how to disallow upload if file size is 0kb? I am using Pure PHP Upload with Dreamweaver MX 2004, and it's going great except that the sucker will let you upload an empty file. I figure I can add in a line or 3 to make this not happen. Anybody got any suggestions?

Many thanks,

Bob

[Merve]

[man]filesize[/man]

[bbeban]

Hi, thanks for replying; but, I am a total newbie -- can you say more? What code would i use to check the filesize and kick in an error if it was 0?

Thanks in advance for a little more input --

[Merve]

if(!filesize(<insert file here>)>0) {
     unlink(<insert file here>);
}

[bbeban]

This didn't do anything:

<?php
if(!filesize($HTTP_POST_VARS['file'])>0) {
unlink($HTTP_POST_VARS['file']);
}
?>

Did I do something wrong here?

[weevil]

Post the code that you have that uploads the file

[Merve]

Don't use the $HTTP_POST_VARS array. Use the $_FILES array.

[leatherback]

Hi,

The $_FILES variable is an array which should also hold the filesize:

$limit_size = 0;
$file_size = $_FILES[file][size];

if ($limit_size >= $file_size)
 {
 $endresult = "File was too small";
 }
 else
   {
   move_uploaded_file($file_name, $newfile)
   $endresult = "Thankyou for uploading";
   }

[bbeban]

Hi All,

I am using Pure PHP Upload 2.0 for this and it doesn't work with $FILES, only $HTTP_POST_VARS.

It sounds like the best way to go is to add in this code to check the $_FILES variable separately from the Pure PHP Upload code. Here are two of the components of the code right now, including the portion that is not working (I will paste the third part in another post):

-----1st part: php code from the page-----

<?php require_once('ScriptLibrary/incPureUpload.php'); ?>
<?php
// Pure PHP Upload 2.0.0
if (isset($HTTP_GET_VARS['GP_upload'])) {
$ppu_thepath = "Resources/images";
$ppu_extensions = "GIF,JPG,JPEG";
$ppu_formName = "form1";
$ppu_redirectURL = "";
$ppu_storeType = "path";
$ppu_sizeLimit = "";
$ppu_nameConflict = "error";
$ppu_requireUpload = "true";
$ppu_minWidth = "";
$ppu_minHeight = "";
$ppu_maxWidth = "165";
$ppu_maxHeight = "165";
$ppu_saveWidth = "";
$ppu_saveHeight = "";
$ppu_timeout = "600";
$ppu_progressBar = "";
$ppu_progressWidth = "300";
$ppu_progressHeight = "100";
ppu_checkVersion(2.0);
ppu_upload($ppu_thepath,$ppu_extensions,$ppu_redirectURL,$ppu_storeType,$ppu_sizeLimit,$ppu_nameConflict,$ppu_minWidth,$ppu_minHeight,$ppu_maxWidth,$ppu_maxHeight,$ppu_saveWidth,$ppu_saveHeight,$ppu_timeout);
}
$GP_uploadAction = $HTTP_SERVER_VARS['PHP_SELF'];
if (isset($HTTP_SERVER_VARS['QUERY_STRING'])) {
$GP_uploadAction .= "?" . $HTTP_SERVER_VARS['QUERY_STRING'] . "GP_upload=true";
} else {
$GP_uploadAction .= "?" . "GP_upload=true";
}
?>
<?php
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
$theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;

case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}

$editFormAction = $SERVER['PHP_SELF'];
if (isset($SERVER['QUERY_STRING'])) {
$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($POST["MM_update"])) && ($POST["MM_update"] == "form1")) {
$updateSQL = sprintf("UPDATE tablename SET photo=%s WHERE recordid=%s",
GetSQLValueString($HTTP_POST_VARS['file'], "text"),
GetSQLValueString($_POST['emprecordid'], "int"));

mysql_select_db($database_axondbset2, $axondbset2);
$Result1 = mysql_query($updateSQL, $axondbset2) or die(mysql_error());

$updateGoTo = "upload_confo.php";
if (isset($SERVER['QUERY_STRING'])) {
$updateGoTo .= (strpos($updateGoTo, '?')) ? "&" : "?";
$updateGoTo .= $SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $updateGoTo));
}

mysql_select_db($database_name, $connection_name);
$query_tablename_edit = "SELECT * FROM tablename WHERE tablename.logon = '$logon'";
$tablename_edit = mysql_query($query_tablename_edit, $connection_name) or die(mysql_error());
$row_tablename_edit = mysql_fetch_assoc($tablename_edit);
$totalRows_tablename_edit = mysql_num_rows($tablename_edit);
?>
<?php
if(!filesize($HTTP_POST_VARS['file'])>0) {
unlink($HTTP_POST_VARS['file']);
}
?>

<?php
if (isset($editFormAction)) {
if (isset($HTTP_SERVER_VARS['QUERY_STRING'])) {
$editFormAction .= "&GP_upload=true";
} else {
$editFormAction .= "?GP_upload=true";
}
}
?>

-----2nd part: the form and surrounding HTML & PHP-----

<form action="<?php echo $editFormAction; ?>" method="post" enctype="multipart/form-data" name="form1" onSubmit="checkFileUpload(this,'',true,'','','',165,165,'','');return document.MM_returnValue">
<input type="hidden" value="<?php echo $row_tablename_edit['recordid']; ?>" name="emprecordid">
<table width="100%" border=0 cellpadding=0 cellspacing=6>
<tr>
<td width="2" class="Normal">&nbsp;</td>
<td align="left" valign="top" class="pagetext"><strong>Upload New</strong> <table width="300" border="0" cellspacing="0" cellpadding="3">
<tr align="left" valign="top" class="smaller">
<td width="92">&nbsp;</td>
<td width="300"><input name="file" type="file" class="smaller" id="file" onChange="checkOneFileUpload(this,'GIF,JPG,JPEG',true,'','','',165,165,'','')" size="30">
<br>
Current photo name: <?php echo basename($row_tablename_edit['photo']); ?> </td>
</tr>
<tr align="left" valign="top" class="smaller">
<td>&nbsp;</td>
<td><input name="Submit" type="submit" value="Submit"></td>
</tr>
</table> </td>
</tr>
</table>
<input type="hidden" name="MM_update" value="form1">
</form>
</div>
</body>
</html>
<?php
mysql_free_result($tablename_edit);
?>

[bbeban]

-----3rd part: the Pure PHP Upload script itself-----

<?php
function ppu_checkVersion($ppu_version) {
$ppu_curversion = 2.0;
if ($ppu_version < $ppu_curversion) {
ppu_error("version","");
}
}

function ppu_checkImageSize($ppu_filename,$ppu_thepath) {
global $HTTP_POST_VARS,$ppu_minWidth,$ppu_minHeight,$ppu_maxWidth,$ppu_maxHeight,$ppu_saveWidth,$ppu_saveHeight;
if ($ppu_imageSize = GetImageSize("$ppu_thepath/$ppu_filename")) {
if (($ppu_minWidth <> "" && $ppu_imageSize[0] < $ppu_minWidth) || ($ppu_minHeight <> "" && $ppu_imageSize[1] < $ppu_minHeight)) {
ppu_error("smallsize",$ppu_filename);
}
if (($ppu_maxWidth <> "" && $ppu_imageSize[0] > $ppu_maxWidth) || ($ppu_maxHeight <> "" && $ppu_imageSize[1] > $ppu_maxHeight)) {
ppu_error("bigsize",$ppu_filename);
}
$HTTP_POST_VARS[$ppu_saveWidth] = $ppu_imageSize[0];
$HTTP_POST_VARS[$ppu_saveHeight] = $ppu_imageSize[1];
}
}

function ppu_checkDir($ppu_dir) {
if(!is_dir($ppu_dir)) {
$ppu_dirs = explode("/",$ppu_dir);
$ppu_tempdir = $ppu_dirs[0];
$ppu_write = false;
for($ppu_i = 1;$ppu_i < count($ppu_dirs);$ppu_i++) {
if (is_writeable($ppu_tempdir)) {
$ppu_write = true;
} else {
$ppu_errdir = $ppu_tempdir;
}
$ppu_tempdir .= "/".$ppu_dirs[$ppu_i];
if(!is_dir($ppu_tempdir)) {
if ($ppu_write) {
mkdir($ppu_tempdir, 0777);
chmod($ppu_tempdir, 0777);
} else {
ppu_error("permission",$ppu_errdir);
}
}
}
}
}

function ppu_checkFileSize($ppu_filename,$ppu_size) {
global $ppu_sizeLimit;
if ($ppu_sizeLimit < $ppu_size) {
ppu_error("size",$ppu_filename);
}
}

function ppu_checkExtensions($ppu_filename,$ppu_extensions) {
$ppu_extallow = false;
foreach (split(",",$ppu_extensions) as $ppu_extension) {
$ppu_ext = substr($ppu_filename, -(strlen($ppu_extension)), strlen($ppu_extension));
if (strtoupper($ppu_ext) == strtoupper($ppu_extension)) {
$ppu_extallow = true;
}
}
if ($ppu_extallow == false && $ppu_filename <> "") {
ppu_error("extension",$ppu_filename);
}
}

function ppu_createUniqName($ppu_filename,$ppu_thepath) {
$ppu_uniq = 0;
$ppu_pos = strrpos($ppu_filename,".");
$ppu_name = substr($ppu_filename, 0, $ppu_pos);
$ppu_ext = substr($ppu_filename, $ppu_pos+1);
while (++$ppu_uniq) {
if (!file_exists("$ppu_thepath/$ppu_name".""."$ppu_uniq.$ppu_ext")){
return "$ppu_name".""."$ppu_uniq.$ppu_ext";
}
}
}

function ppu_moveFile($ppu_source,$ppu_dest) {
global $ppu_thepath;
if (is_writeable($ppu_thepath)) {
if(move_uploaded_file($ppu_source, $ppu_dest)) {
chmod ($ppu_dest, 0644);
$ppu_done[] = $ppu_dest;
} else {
ppu_error('writeperm',$ppu_dest);
}
} else {
ppu_error('writeperm',$ppu_dest);
}
}

function ppu_error($ppu_error,$ppu_filename) {
global $ppu_done;
switch ($ppu_error) {
case 'version':
echo "<b>You don't have latest version of incPHPupload.php uploaded on the server.</b><br>";
echo "This library is required for the current page.<br>";
echo "It is fully backwards compatible so old pages will work as well.<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'permission':
echo "<B>Not enough permissions</B><br><br>";
echo "Folder <b>$ppu_filename</b> can not be created,<br>";
echo "Set the permissions of the parentmap correctly<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'writeperm':
echo "<B>Not enough permissions</B><br><br>";
echo "File <b>$ppu_filename</b> can not be created,<br>";
echo "Set the permissions of the parentmap correctly<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'smallsize':
echo "<B>Imagesize exceeds limit!</B><br><br>";
echo "Uploaded Image $ppu_filename is too small!<br>";
echo "Should be at least $ppu_minWidth x $ppu_minHeight<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'bigsize':
echo "<B>Imagesize exceeds limit!</B><br><br>";
echo "Uploaded Image $ppu_filename is too big!<br>";
echo "Should be max $ppu_maxWidth x $ppu_maxHeight<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'size':
echo "<B>Size exceeds limit!</B><br><br>";
echo "Filename: $ppu_filename<br>";
echo "Upload size exceeds limit of $ppu_sizeLimit kb<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'extension':
echo "<B>Extension is not allowed!</B><br><br>";
echo "Filename: $ppu_filename<br>";
echo "Only the following file extensions are allowed: $ppu_extensions.<br>";
echo "Please select another file and try again.<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'empty':
echo "<B>An error has occured saving uploaded file!</B><br><br>";
echo "Filename: $ppu_filename<br>";
echo "File is not uploaded correctly or is empty.<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
case 'exist':
echo "<B>File already exists!</B><br><br>";
echo "Filename: $ppu_filename<br>";
echo "Please correct and <A HREF=\"javascript:history.back(1)\">try again</a>";
break;
}
if (isset($ppu_done)) {
if (count($ppu_done) > 0) {
foreach ($ppu_done as $ppu_field => $ppu_value) {
unlink($ppu_value);
}
}
}
exit;
}

function ppu_upload($ppu_thepath,$ppu_extensions,$ppu_redirectURL,$ppu_storeType,$ppu_sizeLimit,$ppu_nameConflict,$ppu_minWidth,$ppu_minHeight,$ppu_maxWidth,$ppu_maxHeight,$ppu_saveWidth,$ppu_saveHeight,$ppu_timeout) {
global $HTTP_POST_VARS,$HTTP_SERVER_VARS,$HTTP_POST_FILES;
$ppu_done = array();
set_time_limit ($ppu_timeout);
$ppu_fullpath = "/".substr($HTTP_SERVER_VARS['PHP_SELF'], 1, strrpos($HTTP_SERVER_VARS['PHP_SELF'],"/")).$ppu_thepath."/";
ppu_checkDir($ppu_thepath);
foreach ($HTTP_POST_FILES as $ppu_field => $ppu_value) {
$ppu_filename = $HTTP_POST_FILES[$ppu_field]['name'];
$ppu_size = round(($HTTP_POST_FILES[$ppu_field]['size']/1024), 0);
if ($ppu_sizeLimit <> "") {
ppu_checkFileSize($ppu_filename,$ppu_size);
}
ppu_checkExtensions($ppu_filename,$ppu_extensions);
if (is_uploaded_file($HTTP_POST_FILES[$ppu_field]['tmp_name'])) {
if (file_exists("$ppu_thepath/$ppu_filename")) {
switch ($ppu_nameConflict) {
case 'over':
ppu_moveFile($HTTP_POST_FILES[$ppu_field]['tmp_name'],"$ppu_thepath/$ppu_filename");
break;
case 'error':
ppu_error("exist", $ppu_filename);
break;
case 'uniq':
$ppu_filename = ppu_createUniqName($ppu_filename,$ppu_thepath);
ppu_moveFile($HTTP_POST_FILES[$ppu_field]['tmp_name'],"$ppu_thepath/$ppu_filename");
break;
default:
ppu_moveFile($HTTP_POST_FILES[$ppu_field]['tmp_name'],"$ppu_thepath/$ppu_filename");
}
} else {
ppu_moveFile($HTTP_POST_FILES[$ppu_field]['tmp_name'],"$ppu_thepath/$ppu_filename");
}
if ($ppu_storeType=="path") {
$HTTP_POST_VARS[$ppu_field] = $ppu_fullpath.$ppu_filename;
} else {
$HTTP_POST_VARS[$ppu_field] = $ppu_filename;
}
ppu_checkImageSize($ppu_filename,$ppu_thepath);
} elseif ($ppu_filename <> "") {
ppu_error("empty", $ppu_filename);
} else {
$HTTP_POST_VARS[$ppu_field] = "";
}
}
if ($ppu_redirectURL != "") {
if (isset($HTTP_SERVER_VARS['QUERY_STRING'])) {
$ppu_redirectURL .= (strpos($ppu_redirectURL, '?')) ? "&" : "?";
$ppu_redirectURL .= $HTTP_SERVER_VARS['QUERY_STRING'];
}
header(sprintf("Location: %s", $ppu_redirectURL));
}
}
?>