MIME Typs not working in FF

DefunctExodus

I am having some issues with MIME Types,

For some reason everything works fine in IE But in FF i am unable to use

application/vnd.ms-excel

And

application/msword

It does not seem to recognize the content in Firefox

These are being used to Upload content to a SQL DB

Any ideas on what i am doing wrong? i have tried all the MIME types that i can find for XLS and none of them seem to work in FF

NogDog

I don't believe Firefox has a plug-in for either of those, so all it can do is either download the file or display the raw code.

DefunctExodus

Yeah i am fine with downloading, My issue is that i am trying to limit the file type that can be uploaded by php to a mysql DB,

However it does not seem to except these mime types. They work fine in IE though,.

NogDog

Are you talking about the $_FILES['filename']['type'] value when you upload a file? If so, that value is whatever the browser decides to send (or not send), and thus cannot be depended on to be correct and is easily spoofed by a hacker. If you're talking about something else, then we probably need more info and maybe a look at the code in qeustion.

DefunctExodus

Here is some sample code

if(UPLOAD){
	if(is_uploaded_file($_FILES['file']['tmp_name'])){
		$strFilename = $_FILES['file']['name'];
		$intFilesize = $_FILES['file']['size'];
		$strFiletype = $_FILES['file']['type'];
		$strFiletmp = $_FILES['file']['tmp_name'];

	$objFile = fopen($strFiletmp, 'r');
	$strFilecontent = fread($objFile, $intFilesize);
	$strFilecontent = mysql_real_escape_string(base64_encode($strFilecontent));
	fclose($objFile);

	if($strFiletype == "image/jpeg" || $strFiletype == "image/pjpeg" || $strFiletype == "application/rtf" || $strFiletype == "excel/ms-excel" || $strFiletype == "text/plain" || $strFiletype == "application/vnd.ms-excel" || $strFiletype == "application/msword"){



			$blnUpload = true;

	} else {

		$blnUpload = false;
		$blnWrong = true;

	}

NogDog

DefunctExodus wrote:
$strFiletype = $_FILES['file']['type'];

As per my earlier suspicion, you are depending on the $_FILES['file']['type'] value to decide whether or not to process the file. That puts you at the mercy of whether or not the browser is (a) smart enough to figure it out, (b) using the same mime type nomenclature as you are, and/or (c) even bothering to send it at all. On top of this, PHP does no validation of this value, so a hacker could send you a virus file and set whatever mime type he wants in the HTTP header.

DefunctExodus

NogDog,

Well how do i suggest i could go about it then?

NogDog

You could use the PEAR MIME_Type class to get the file's mime-type, perhaps.

Oersoep

If you're using unix there's a command line tool called 'file'

user@server: ~ $ file something.log
something.log: ASCII text

It actualle checks the first few bytes, so it even recognizes jpg when you call it img.txt.

That one might know excel. Or just say application/octetstream or something 🙂

Weedpacket

Oersoep wrote:
It actualle checks the first few bytes, so it even recognizes jpg when you call it img.txt.
That one might know excel.

To be precise, if it uses the same magic.mime db file that the PEAR class uses - distributed with PHP - then it will look for "Microsoft Excel 5.0 Worksheet" starting at file offset 2080, (and return the desired "application/vnd.ms-excel").

The PEAR class will use [man]finfo_file[/man] if it can find it; if it can't it will try [man]mime_content_type[/man]; and if that fails it will fall back on the system file(1) command.