RE: FN-FORUM: file size /type best practice

date posted 29th January 2007 17:54

[EMAIL REMOVED] wrote:
>> Probably being ignorant here, but without using a Java app/flash
>> object (not sure on flash) to manage the file upload I didn't think
>> you had access to the size of the file until the form had completed
>> submission.
>>
>
> Yeah that's the impression I'm under too, but was hoping I would be
> wrong
>
> D

True in (out of the box) PHP afaik since PHP processes the uploaded file
into the temp directory before your script even gets called (same reason you
can't set max upload size ini setting on the fly in your script), however if
you have direct access to the request e.g. when handling CGI raw in Perl you
should be able to discover the size of the request at the beginning and
hence decide if you want to accept the file (provided the client provides
this info, but I believe most do).

This is also why most upload progress bars for PHP are actually implemented
in perl CGI and hooked back to PHP via a unique upload ID to allow checking
of progress from PHP and handling of the resulting upload by a PHP script.

So the short answer is no way to check file before it is uuploaded to server
in "native" PHP (reason I keep qualifying that is that I have seen a
modified source version of PHP that does it but good luck using that on a
server you don't have 100% control of).

Wrt the discussions about type, certain file types (e.g. images) you may be
able to check directly but without an armoury of proprietary libraries most
file uploads you have to trust the extension.

I am not a security expert, but it seems to me that how big an issue this is
depends on the purpose of the files. If the files will only ever be made
available through the same website then extension is what matters anyway as
this is how the webserver will determine mime type to deliver back when the
file is later requested. An executable uploaded as .gif and then accessed
via the same web server will not execute aty the browser, as it will be
served to the browser as image/gif mime type (assuming standard set-up).

Where there is an issue is if the file will be used elsewhere that it's
fundamental nature as an exe may cause issues. Also I suppose it may be a
first step on a multi-step hack if the hacker could subsequently rename the
file somehow or change web server config.

Regards,

Dai