Avatar billede raws Nybegynder
28. april 2007 - 12:03 Der er 1 kommentar

fejl i php

hvad er problemet i det her upload script?


<?
/*
* PHP Freaks Code Library
* http://www.phpfreaks.com/quickcode.php
*
* Title: image uploader v0.13
* Version: 1.0
* Author: Joonas Lauhala aka(joonas905)
* Date: Wednesday, 04/11/2007 - 09:25 PM
*
*
*
* NOTICE: This code is available from PHPFreaks.com code Library.
*        This code is not Copyrighted by PHP Freaks.
*
*        PHP Freaks does not claim authorship of this code.
*
*        This code was submitted to our website by a user.
*
*        The user may or may not claim authorship of this code.
*
*        If there are any questions about the origin of this code,
*        please contact the person who submitted it, not PHPFreaks.com!
*
*        USE THIS CODE AT YOUR OWN RISK! NO GUARANTEES ARE GIVEN!
*
* SHAMELESS PLUG: Need WebHosting? Checkout WebHost Freaks:
*                http://www.webhostfreaks.com
*                WebHosting by PHP Freaks / The Web Freaks!
*/


// *    Description / Example:
// *   
// *    FEATURES:
// *   
// *    \"image uploader\" v0.13
// *    ************************************************
// *   
// *    - upload images
// *    - preview uploaded image
// *    - recognizes many filetypes
// *    - easy-to-understand errors
// *    - easy-to-customate settings/styles
// *   
// *    \"image uploader\" v0.17 (next version)
// *    *********************************************
// *   
// *    - all version 0.13 features
// *    - hide image source
// *    - multiple file uploads

?>

<style>
body{ background:#aacbfd; color:#000000; font-family:Arial; }
div{ border:solid 1px #000000; background:#83acf1; padding:10px; margin:5px 5px 5px 5px; }
form{ margin:0px; padding:0px; } .upload{ border:solid 1px #000000; background:#cccccc; height:20px; }
a:link, a:active, a:visited{ color:#0000ff; text-decoration:none; } a:hover{ text-decoration:underline; }
</style></head><body><div>
<?php
$mode = $_GET[ \"mode\" ];
$submit = $_POST[ \"images\" ];
$files = $_FILES[ \"content\" ];
$php = $_SERVER[ \"PHP_SELF\" ];
$size = $files[ \"size\" ];
$type = $files[ \"type\" ];
$name = $files[ \"name\" ];
$temp = $files[ \"tmp_name\" ];
$max_size = 3000024;  // Maximum filesize ( bytes )
$path = \"/data/cluster/free1go/r/a/www.raws.1go.dk/billeder/images/";    // Upload directory
if( !file_exists( dirname( $path ) ) ) {
mkdir( dirname( $path ) ); }
if( isset( $mode, $submit, $files ) && $mode == \"upload\" && $size > 0 ) {
$mimes = array( \"image/pjpeg\", \"image/gif\", \"image/png\",\"image/bmp\",
\"image/fif\", \"image/ief\", \"image/tiff\", \"image/x-portable-bitmap\",
\"image/x-portable-graymap\", \"image/x-portable-pixmap\", \"image/x-xbitmap\",
\"image/x-xpixmap\", \"image/x-xres\", \"image/x-icon\", \"image/jpeg\" );
  if( $size <= $max_size ) {
    if( !file_exists( \"$path/$name\" ) ) {
      $search = in_array( $type, $mimes );
      if( $search == true && move_uploaded_file( $temp, \"$path/$name\" ) ) {
        $output = \"<b>File uploaded with success!</b><br>
        <a href=\\\"$php\\\">Upload more files...</a><br><br>
        <img src=\\\"$path/$name\\\">\";
      } else {
        $output = \"<b>Code #FU001: wrong filetype found!</b><br>
        <a href=\\\"$php\\\">Upload only acceptable one(s).</a>\"; }
    } else {
      $output = \"<b>Code #FU002: file already exists!</b><br>
        <a href=\\\"$php\\\">Upload different file.</a>\"; }
  } else {
    $output = \"<b>Code #FU003: file is too large!</b><br>
    <a href=\\\"$php\\\">Try to upload smaller file!</a>\"; }
} else {
  $output = \"<form action=\\\"$php?mode=upload\\\" method=\\\"post\\\" enctype=\\\"multipart/form-data\\\">
  <b>Upload file:</b><br><input type=\\\"file\\\" name=\\\"content\\\" size=\\\"25\\\" class=\\\"upload\\\">
  <input type=\\\"submit\\\" name=\\\"upload\\\" value=\\\"Upload\\\" class=\\\"upload\\\"></form>\"; }
echo( $output );
?>
Avatar billede erikjacobsen Ekspert
28. april 2007 - 12:22 #1
1) Der er for mange \-ere
2) Der tjekkes ikke for extension på uploadede filer, så en hacker kan uden videre uploade en PHP-fil og lave alt om på dit site. Du skal ikke bruge dette script, hvis det er offentligt tilgængeligt.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Vi tilbyder markedets bedste kurser inden for webudvikling

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester