[RESOLVED] Finding File Type

Thora_Fan

What is the best way to find out a file type of a certain file? I have a script I wrote that handles uploads, and I read somewhere (can't remember where) that relying on $_FILES['fileID']['type'] is not completely safe.

The files for the particular project I'm working on will just be images, jpegs to be exact, but I would like to write this in such a way that I can use it for other file types in the future (like zip files).

Any thoughts?

NogDog

[man]Fileinfo[/man] PECL extension

MIME_Type PEAR package

Thora_Fan

NogDog to the rescue again.

Gracias.

sneakyimp

I'm no expert here but I believe that $_FILES['fileID']['type'] will be determined by the remote browser rather than your server. This means it could be spoofed by a hacker to make an EXE seem like a JPG. AFAIK the only way to be certain that an uploaded file is actually an image is to verify its format using some library function.

You could, for example do this:

$image_info = getimagesize($uploaded_file);
if ($image_info === false) {
  die('THIS IS NOT A VALID IMAGE');
}

For zip files, you'd probably have to do something similar with a different library. Or perhaps use [man]exec/man to see what the command line zip function has to say about it.

sneakyimp

oh wow! nice one nogdog.

sneakyimp

So I've been trying that Pear package and all I ever get is "Sorry, couldn't determine file type." Is anyone else having that problem? This code:

<?php
require_once 'MIME/Type.php';

$filename = '/home/sneakyimp/public/images/redpix.gif';
if (!file_exists($filename)) {
  die ('you moron that file doesn\'t exist');
}
passthru('ls -l ' . $filename);
echo '<br>';
$type     = MIME_Type::autoDetect($filename);
if (PEAR::isError($type)) {
    die($type->getMessage());
}

?>

returns this:

-rw-r--r-- 1 sneakyimp sneakyimp 41 Dec 6 2006 /home/sneakyimp/public/images/redpix.gif
Sorry, couldn't determine file type.

sneakyimp

I'm also having trouble with Fileinfo. I'm pretty sure I have it installed but can't be certain:

server: pecl install -f Fileinfo
BLAH
BLAH
BLAH
.
.
.
Build process completed successfully
Installing '/usr/lib/php5/20060613+lfs/fileinfo.so'
install ok: channel://pear.php.net/Fileinfo-1.0.4
server:/home/jaith/public#

And yet the finfo functions are not defined in php even after apache restart. This code results in "Fatal error: Call to undefined function finfo_file() in /home/sneakyimp/public/chump.php on line 29":

<?php

$filename = '/home/sneakyimp/public/war3.jpg';
$magic_file = '/usr/share/file/magic.mime';

$finfo = finfo_open(FILEINFO_MIME, $magic_file); // return mime type ala mimetype extension

if (!$finfo) {
    echo "Opening fileinfo database failed";
    exit();
}

/* get mime-type for a specific file */
echo finfo_file($finfo, $filename);

/* close connection */
finfo_close($finfo);
?>

I've also tried the object-oriented style without any luck.