"getimagesize()" for non-images

[ppowell]

Is there something within PHP that can check if a non-image file is what it is supposed to be (something like a "reality check" for files - if this file really IS what it says it is)?

I can do it using getimagesize() but that only applies to images. The tool I am tasked to build needs to verify that anything is exactly what it says it is. I was using an XML parsed variation of /etc/mime.types but that tends to be unbearably slow, so I am looking for a more practical solution.

Thanx
Phil

[Erkilite]

Most binary files have a 'header' in them. The first few bytes of the file include an identifier. Not all filetypes have the same specification but if you are looking to exclude or allow a specific file type, then look up those file formats and see if an identifier is included in the headers.

HTH

[ppowell]

due to the nature of the code structure, I cannot use headers, but I read somewhere about get_mime_content in PHP that reads out the MIME type of any file, assuming I could do this:

if (!preg_match("/$allowableMimePrefix\\//i", mime_content_type($_FILES[$section]['name']])) { // NOT ALLOWED HERE
}

Phil

[Erkilite]

i dont think thats the right function name

try this

http://us2.php.net/manual/en/function.mime-content-type.php

[Weedpacket]

Originally posted by ppowell
due to the nature of the code structure, I cannot use headers, but I read somewhere about get_mime_content in PHP that reads out the MIME type of any file, assuming I could do this:

Well, yes; given a magic.mime file [man]mime_content_type[/man] does what Erkilite originally suggested; looks at certain bytes in the file to see if they conform to certain patterns (they're called "magic numbers", hence the name). For example, the first four bytes of a PNG file are always \x89PNG, while a Java class file always starts with the number 0xcafebabe.

[ppowell]

if (preg_match('/^image\/i', mime_content_type($_FILES[$section]['tmp_name']))) {
		  // SPECIAL HANDLING OF FileValidator OBJECT IF THE FILE IS DETECTED TO BE AN IMAGE ACCORDING TO mime_content_type
		  $fileValidator =& new FileValidator('image', true);
		 } else {
		  $fileValidator =& new FileValidator('image');
		 }

Failed.. received following error message:

Fatal error: Call to undefined function: mime_content_type() in /www/html/mu-spin/image_catalog/include/image_classes.inc.php on line 156

I am using PHP 4.3.2 for Red Hat 7.3

Phil

[Erkilite]

if you are trying to access an mime type of an uploaded file you can try

$_FILES['userfile']['type']

this will give you the mime type provided the browser provided it, you wouldn't need to use the other function

[mrhappiness]

assuming that the browser will send the correct mime-type: yes

but if i rename styles.css to styles.jpg the mime-type within $_FILES surely won't be text/css butimage/jpg or someting like this

and what if i upload agende.doc andhave no word installed at the time of upload?
do you think it will be application/vnd.ms-word or application/octet-stream

"Never trust incoming data" is for $_FILES also...

[ppowell]

I came up with a rather weird workaround that I found in the PHP Manual, of course:

/*-----------------------------------------------------------------------------------------------------------------------
	Note: Certain variations of PHP may not have this function installed within php.ini if this is
	the case this function will kick in instead
------------------------------------------------------------------------------------------------------------------------*/
if (!function_exists('mime_content_type')) {
 function mime_content_type($file) {
  return exec('file -bi ' . escapeshellarg($file));
 }
}

That seems to work just fine, but I would like to know how many more "core" functions in PHP are not really there when they say there are even in the correct versions.

Phil

[Weedpacket]

Originally posted by ppowell
That seems to work just fine, but I would like to know how many more "core" functions in PHP are not really there when they say there are even in the correct versions.

[man]mime_magic[/man]
Installation

You must compile PHP with the configure switch [font=monospace]--with-mime-magic[/font] to get support for mime-type functions. The extension needs a copy of the simplified [font=monospace]magic[/font] file that is distributed with the Apache httpd.

Note: The configure option has been changed from [font=monospace]--enable-mime-magic[/font] to [font=monospace]--with-mime-magic[/font] since PHP 4.3.2

Note: This extension is not capable of handling the fully decorated [font=monospace]magic[/font] file that generally comes with standard Linux distro's and is supposed to be used with recent versions of [font=monospace]file[/font] command.

Note to Win32 Users: In order to use this module on a Windows environment, you must set the path to the bundled [font=monospace]magic.mime[/font] file in your [font=monospace]php.ini[/font].

Example 1. Setting the path to magic.mime

[font=monospace]mime_magic.magicfile = "$PHP_INSTALL_DIR\magic.mime"[/font]

Remember to substitute the [font=monospace]$PHP_INSTALL_DIR[/font] for your actual path to [font=monospace]PHP[/font] in the above example. e.g. [font=monospace]c:\php[/font]

[ppowell]

We not only have that file but PHP was installed with that feature after confirming with the folks who set this machine up before me. I double-checked and found magic.mime as well. We even went back into php.ini and set the path to go to magic.mime.. all to no avail, same error exists.

Hence my code solution.

Phil