Delete image function

Savi

Hey!

I found this great upload script which works perfectly, except the 'delete' function. I have no idea as to why it does not work..

Here is the delete function. However I am not sure the error is there.. Maybe the code has gone wrong somewhere else?:

function del(){
// if we want to insert a value inside any function we have to global it first.
global $upload_dir, $file;
$file = $_REQUEST["file"];

//delete the file
@unlink($upload_dir."/".$file);
echo "<h3><font color=red>The File ($file) was deleted! 
Please wait...</font></h3>";
echo "<meta http-equiv="Refresh" content="1";url="upload.php">";
}

//define variable to switch between functions
if( $action == del ){
del();
}
?>

The link (in the same code) you press to delete:

Options[<a title="Delete File\" href=\"javascript:;\" 
onClick=\"cf=confirm('Are you sure you want to delete?');if (cf)
window.location='upload.php?action=del&file=$file'; return false;\">Del</a>]
?>

The file is called upload.php if you had any doubts about that

If there is no errors in this I can post the entire code...

Best Regards
Savi

P.S. Yes, the upload directory IS CHMOD to 777
P.P.S. Removing the '@' does not make the script return any error messages.

cheerio

I don't think you need to put the directory. It's always in the same folder as..itself.
also

if( $action == del ){
del();
}

should be

if( $action == 'del' ){
del();
}

(you need quotes around 'del' so PHP knows it's a string)

mjax

If you get this to work, you should be very careful because this script is vulnerable to exploits.

For instance, if I were to call

upload.php?action=del&file=../../../ect/rc.conf

I would be able to delete files outside of the upload directory.

You should check the $file variable that it doesn't contain any unwanted characters, like .. and /

Savi

Thank you a lot for answering.. I will try these suggestions out, and hopefully it'll work! 🙂
I know it is not a very safe script, but I don't have any important files in there at all and I am protecting the script with a login script 🙂 So it shouldn't cause any trouble.

Cheers
Savi