I'm currently working on the CMS side of a website I did for a client and I'm currently doing the photos section. What I was going to do was have the CMS allow them to upload a jpg to a certain folder. Then have the photos page on the public side just pull from that directory. Just like I do with all my clients. Difference is that this client is on a Windows server which I'm not used to. Anyways to my problem...

Whenever I try and upload to a folder called "uploads" in the root folder I get this error:

"Possible file upload attack! Here's some debugging info:
Array ( [File] => Array ( [name] => nav_01.jpg [type] => image/pjpeg [tmp_name] => D:\PHP\uploadtemp\php4B2.tmp [error] => 0 [size] => 11506 ) ) "

So I reported it to their hosting company to see what they could come up with and they said they were getting this error:

Possible file upload attack! Here's some debugging info:
Array ( [photofile] => Array ( [name] => menu.jpg [type] => image/pjpeg [tmp_name] => C:\WINNT\php887.tmp [error] => 0 [size] => 1742 ) )

Diference is where it's trying to upload. I don't know why it's doing that. Also I've tried a few other things to my code and had it say that my file was uploaded successfully. But then when I view the folder nothing is in it. Seems like it's having trouble moving the file from tmp to uploads. I'm so lost. Someone please help me.

Here's my code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
        "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Upload a File</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>

<?php

$uploaddir = 'D:/domains1/206.114.155.99/uploads/';
$uploadfile = $uploaddir . $_FILES['photofile']['name'];

if (move_uploaded_file($_FILES['photofile']['tmp_name'], $uploadfile)) {
   print "<font class=\"font\">File is valid, and was successfully uploaded.";
} else {
   print "<font class=\"font\">Possible file upload attack!  Here's some debugging info:<br>";
   print_r($_FILES);
}

?>
<p>Upload a file to the server</p>

<form action="upload.php" method="post" enctype="multipart/form-data">
<p>File: <input type="file" name="photofile" size="20"><br/>
<input type="submit" name="submit" value="Upload File"></p></form>

</body>
</html>

Thanks in advance!

Evan

    Write a Reply...