$userfile_type and $userfile_name not working

xeirus

Hi all!
I'm going through a very strange problem.
I have an identical code on BlueHost and GoDaddy.
On BlueHost it does NOT work and on GoDaddy it works just fine.
Both BlueHost and GoDaddy are using PHP v5.2.17
The code is:

      // Validating the Image (userfile)
      if (empty($userfile))
         $errorArray['Image File'] = "Browse and select a GIF/JPEG Image File to upload!";
      elseif (!($userfile_type =="image/pjpeg" OR $userfile_type=="image/gif"))
         $errorArray['Uploaded Image'] = "Your uploaded file must be either JPG or GIF only!";
      elseif (!doesuserfile_nameEventBannerExist($userfile_name))
         $errorArray['Uploaded Image'] = "Filename already Exists, Rename and Upload again!";

Please help !

Thank you 🙂

xeirus

Update
Turned error reporting on and this is the error I'm getting:

Notice: Undefined variable: userfile_type in /home6/user/public_html/eventbanner_uploader.php on line 70

I don't understand why userfile_type is an undefined variable? Isn't it a built-in php variable?

Weedpacket

xeirus wrote:
I don't understand why userfile_type is an undefined variable? Isn't it a built-in php variable?

Short answer: no. In fact, none of the variables that appear in your code are built-in.

If these are supposed to be coming from form fields, the built-in variables are [man]$POST[/man] and [man]$FILEs[/man], and a few others that you will find out about on those pages.

xeirus

Weedpacket;11013573 wrote:
Short answer: no. In fact, none of the variables that appear in your code are built-in.

If these are supposed to be coming from form fields, the built-in variables are [man]$POST[/man] and [man]$FILEs[/man], and a few others that you will find out about on those pages.

Oh ok, I was wrong about that.
The code is now modified as follows, but still doesn't work:

                  if (empty($_FILES['userfile']))                                 $errorArray['Image File'] = "Browse and select a GIF/JPEG Image File to upload!";                  elseif (!($_FILES['userfile']['type'] =="image/pjpeg" OR $_FILES['userfile']['type']=="image/gif"))                                 $errorArray['Uploaded Image'] = "Your uploaded file must be either JPG or GIF only!";                  elseif (!doesuserfile_nameEventBannerExist($_FILES['userfile']['name']))                                 $errorArray['Uploaded Image'] = "Filename already Exists, Rename and Upload again!";

bradgrafelman

What does "doesn't work" mean? Which error statement is getting set? Are you getting any PHP error messages? One issue I see is that you never check to see if the file upload was even successful (see: [man]features.file-upload.errors[/man]) before you attempt to process it. Can you do a [man]print_r/man on the $_FILES array and show us the output?

Also note that checking the 'type' value in the $_FILES array isn't very secure; I can easily upload "my_nasty_virus.exe" and simply claim it's of type "image/gif".

xeirus

bradgrafelman;11013611 wrote:
What does "doesn't work" mean? Which error statement is getting set? Are you getting any PHP error messages? One issue I see is that you never check to see if the file upload was even successful (see: [man]features.file-upload.errors[/man]) before you attempt to process it. Can you do a [man]print_r/man on the $_FILES array and show us the output?

Also note that checking the 'type' value in the $_FILES array isn't very secure; I can easily upload "my_nasty_virus.exe" and simply claim it's of type "image/gif".

Sorry, I should've been more clearer.
I have error reporting turned fully on and there's no error.
And the only validation error I get upon submitting the form is the first error message, which is:
Image File: Browse and select a GIF/JPEG Image File to upload!

print_r($_FILES['userfile']);
Does not give an output

print_r($_FILES);
Only gives,
Array ( )

Please let me know if you want me to check anything else.

bradgrafelman

Can you show us the HTML markup for the form you're submitting when attempting to upload a file?

xeirus

bradgrafelman;11013625 wrote:
Can you show us the HTML markup for the form you're submitting when attempting to upload a file?

Yes, here it is:

   <tr>
      <td>Upload this file:</td>
      <td>:</td>
      <td><INPUT NAME="userfile" TYPE="file"></td>
    </tr>

NogDog

Have you set the proper enctype for your form tag as described here: http://php.net/manual/en/features.file-upload.post-method.php

xeirus

NogDog;11013629 wrote:
Have you set the proper enctype for your form tag as described here: http://php.net/manual/en/features.file-upload.post-method.php

Thanks for the hint, fixed that.
Now the error is stuck on the second form validation error message which is:
Uploaded Image: Your uploaded file must be either JPG or GIF only!

bradgrafelman

Have you tried checking the apparent MIME type your browser reports when you upload whatever image file it is you're uploading?

Then again, you might want to consider a different method of determining the actual MIME type of the content uploaded rather than blindly trusting the user-supplied data (which may or may not be true).

NogDog

Yeah, if it's important to check an image file type, I like to use [man]getimagesize/man, which looks at the actual file data.

xeirus

bradgrafelman;11013633 wrote:
Have you tried checking the apparent MIME type your browser reports when you upload whatever image file it is you're uploading?

Then again, you might want to consider a different method of determining the actual MIME type of the content uploaded rather than blindly trusting the user-supplied data (which may or may not be true).

You're right.
Previously I had this page starting with the following headers and it worked:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

Now I have it as:

<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

What should I change in the HTML5 header if I want this to work?
I just changed it back to HTML4.01 and the whole form worked.

xeirus

Yes, NogDog, that's the next step to improving this upload system, like bradgrafelman said, without verifying the actual file, one may upload a renamed .exe

bradgrafelman

xeirus;11013639 wrote:
What should I change in the HTML5 header if I want this to work?
I just changed it back to HTML4.01 and the whole form worked.

Who ever said anything about the <head> of the HTML document? I suggested looking at the value you're getting for the 'type' index to see why it differs from the two values you're comparing it with.

Then again, why even bother to spend any effort getting this method to work when you know it's the wrong way to do it?

xeirus;11013641 wrote:
without verifying the actual file, one may upload a renamed .exe

Since you don't check the file extension, there wouldn't be any need to even rename the executable file.

NogDog

Looks like an extraneous "p" in this line:

elseif (!($userfile_type =="image/[B][COLOR="#FF0000"]p[/COLOR][/B]jpeg" OR $userfile_type=="image/gif"))

However, as Brad mentioned, the browser is not required to send this data and it can be spoofed, so it's best not to depend on it since you could end up rejecting legitimate uploads while allowing illegitimate ones.

bradgrafelman

NogDog;11013645 wrote:
Looks like an extraneous "p" in this line:

It may be superfluous, but it may not be... for example, a browser might use that MIME type to denote a progressive JPEG image, even though doing so would violate IANA standards. But of course, no browser would ever violate established standards.... (COUGH INTERNET EXPLORER COUGH) ... right? 🙂

xeirus

bradgrafelman;11013643 wrote:
Who ever said anything about the <head> of the HTML document? I suggested looking at the value you're getting for the 'type' index to see why it differs from the two values you're comparing it with.

Then again, why even bother to spend any effort getting this method to work when you know it's the wrong way to do it?

Since you don't check the file extension, there wouldn't be any need to even rename the executable file.

Sorry bradgrafelman, I thought you were referring to the HTML header / encoding of the HTML when you said MIME type, but if not then I don't know anything about the MIME type.

Question, don't the following lines check for the extension? I thought you said that I wasn't checking if the actual file content was a real image.

      elseif (!($userfile_type =="image/pjpeg" OR $userfile_type=="image/gif")) 
         $errorArray['Uploaded Image'] = "Your uploaded file must be either JPG or GIF only!";

xeirus

NogDog;11013645 wrote:
Looks like an extraneous "p" in this line:
elseif (!($userfile_type =="image/[B][COLOR="#FF0000"]p[/COLOR][/B]jpeg" OR $userfile_type=="image/gif"))
However, as Brad mentioned, the browser is not required to send this data and it can be spoofed, so it's best not to depend on it since you could end up rejecting legitimate uploads while allowing illegitimate ones.

If I remove the 'p' would progressive jpegs still be allowed?

bradgrafelman

xeirus;11013649 wrote:
then I don't know anything about the MIME type.

Oh? Then who wrote the code you've been showing us? Because that's exactly what you're checking in the 'type' index of an entry in the $_FILES array. See the PHP manual page [man]features.file-upload.post-method[/man] for more info about the various elements in that array.

xeirus;11013649 wrote:
Question, don't the following lines check for the extension?

No, they don't - they check the MIME type as reported by the browser (and not validated by PHP in any way)... assuming the browser even reported such information, that is. Again, see the manual page I linked to above.