Okay, det var mest for at vise, hvad jeg selv havde defineret som tilladt at uploade. Jeg har ikke selv skrevet upload-scriptet, så jeg skal ikke kunne sige, om der er et hul i det. Men jeg poster gerne lige indholdet af de to filer, hvis der er nogen, der kan give et bud på det. Jeg kan nemlig ikke selv uploade php-filer via upload-scriptet.
Der er to filer: uploader.php og upload.php
Upload.php ser sådan her ud:
<?
include("uploader.php"); // Don't put anything above this line or you'll get errors
?>
<p><strong><span style="background: #fff; color: #000"><? if($_REQUEST["message"] == "") echo "Upload en fil her."; else echo $_REQUEST["message"]?></span></strong></p>
<form action="upload.php" enctype="multipart/form-data" id="upload" method="post">
<p><input id="userfile" name="userfile" size="45" type="file" /><input name="upload" type="submit" value="Upload fil" /><br /></p>
<p>Tilladte filtyper: <strong><?=$file_extensions_list?></strong></p>
<p>Maksimal filstørrelse: <strong><?=$maximum_file_size?> bytes (~<?=round($maximum_file_size/1024)?>KB)</strong></p>
<p>Der er problemer med at uploade filer, som begynder med tre eller flere tal i rækkefølge. Gør din fil det, så omdøb den venligst og prøv igen.</p>
<p>Har du problemer med at uploade? <a href="mailto:XXXXX@XXX.XXX">Skriv til mig.</a> Skriv "fejlmelding" i emnet.</p>
<p>Tilbage til <a href="
http://XXX.XXX" title="XXX.XXX">forsiden.</a></p>
<p>Powered by: <a href="
http://hypersilence.net" title="Silentum Uploader v1.3.0">Silentum Uploader v1.3.0</a></p>
</form>
</table>
Uploader.php ser sådan her ud:
<?
/*
Silentum Uploader v1.3.0
Modified November 23, 2007
uploader.php copyright 2005-2007 "HyperSilence"
*/
// Begin options
$allow_file_deletion = true; // To allow visitors to delete files, leave this at true; otherwise, change it to false
$file_extensions = array(".3gp", ".3gpp", ".3g2", ".amr", ".avi", ".bmp", ".doc", ".flv", ".gif", ".jpg", "jpeg", ".m4a", ".mov", ".mp2", ".mp2a", ".mp3", ".mp4", ".mpe", "mpeg", ".mpg", ".ogg", ".ogm", ".png", ".swf", ".txt"); // Add or delete the file extensions you want to allow
$file_extensions_list =".3gp, .3gpp, .3g2, .amr, .avi, .bmp, .doc, .flv, .gif, .jpg, .jpeg, .m4a, .mov, .mp2, .mp2a, .mp3, .mp4, .mpe, .mpeg, .mpg, .ogg, .ogm, .png, .swf, .txt"; // Type the same as above, without the quotes separating them
$max_length = 45; // The maximum character length for a file name
$maximum_file_size = "20480000"; // In bytes
$upload_log_file = "upload_log.txt"; // Change this to the log file you want to use
// End options
$folder_directory = "
http://".$_SERVER["HTTP_HOST"].dirname($_SERVER["PHP_SELF"]);
$message = "";
$set_chmod = 0;
$site_uri = "
http://".$_SERVER["HTTP_HOST"].$_SERVER["PHP_SELF"]; $upload_directory = "";
$upload_uri = $folder_directory."/";
if($allow_file_deletion == true) $status = "Tilladt";
else $status = "Ikke tilladt";
if($_REQUEST["delete"] && $allow_file_deletion) {
$resource = fopen($upload_log_file,"a");
fwrite($resource,date("F d, Y / h:i:sa")." - ".$_REQUEST["delete"]." Slettet af ".$_SERVER["REMOTE_ADDR"]."\n");
fclose($resource);
if(strpos($_REQUEST["delete"],"/.") > 0);
elseif(strpos($_REQUEST["delete"],$upload_directory) === false);
elseif(substr($_REQUEST["delete"],0,6) == $upload_directory) {
unlink($_REQUEST["delete"]);
$message = "Filen er blevet slettet.";
header("Location: $site_uri?message=$message");
}
}
elseif($_FILES["userfile"]) {
$resource = fopen($upload_log_file,"a");
fwrite($resource,date("F d, Y / h:i:sa")." - ".$_FILES["userfile"]["name"]." "
.$_FILES["userfile"]["type"]." uploadet af".$_SERVER["REMOTE_ADDR"]."\n");
fclose($resource);
$file_type = $_FILES["userfile"]["type"];
$file_name = $_FILES["userfile"]["name"];
$file_ext = strtolower(substr($file_name,strrpos($file_name,".")));
@chmod($upload_uri."".$file_name, 0755);
if($_FILES["userfile"]["size"] > $maximum_file_size) {
$message = "FEJL: Filen må ikke være større end ".$maximum_file_size." bytes.";
}
elseif($file_name == "") $message = "FEJL: Vælg venligst den fil, du vil uploade.";
elseif(strlen($file_name > $max_length)) $message = "FEJL: Filens navn må ikke være længere end ".$max_length." karakterer. Omdøb filen og prøv igen.";
elseif(!preg_match("/^[A-Z0-9_.\- ]+$/i",$file_name)) $message = "FEJL: Filnavnet indholder ugyldige karakterer.";
elseif(!in_array($file_ext, $file_extensions)) $message = "FEJL: <ins>$file_ext</ins> er ikke en tilladt filtype.";
else $message = upload_file($upload_directory, $upload_uri);
header("Location: $site_uri?message=$message");
}
elseif(!$_FILES["userfile"]);
else $message = "FEJL: Du har valgt en ugyldig fil.";
$open = opendir($upload_directory);
$uploaded_files = "";
while($file = readdir($open)) {
if(!is_dir($file) && !is_link($file)) {
$uploaded_files .= " <tr>
<td style=\"background: #fff; color: #000; text-align: left; width: 70%\"><a href=\"$upload_directory$file\" title=\"$file (".filesize($upload_directory.$file)." bytes)\">".$file."</a> (".filesize($upload_directory.$file)." bytes)</td>";
if($allow_file_deletion)
$uploaded_files .= "
<td style=\"background: #fff; color: #000; text-align: right; width: 30%\"><a href=\"?delete=$upload_directory".urlencode($file)."\" title=\"Delete File\">Delete File</a></td>";
else
$uploaded_files .= "
<td style=\"background: #fff; color: #000; text-align: right; width: 30%\"><del><strong>Delete File</strong></del></td>";
$uploaded_files .= "
</tr>
<tr>
<td colspan=\"2\" style=\"background: #eee; color: #000; text-align: left; text-indent: 20px\">Uploaded <strong>".date("F d, Y / h:ia", filemtime($upload_directory.$file))."</strong></td>";
$uploaded_files .="
</tr>
";
}
}
function upload_file($upload_directory, $upload_uri) {
$file_name = $_FILES["userfile"]["name"];
$file_name = str_replace(" ","_",$file_name);
$file_path = $upload_directory.$file_name;
$temporary = $_FILES["userfile"]["tmp_name"];
$result = move_uploaded_file($temporary, $file_path);
if(!chmod($file_path,0777))
$message = "FEJL: Upload-biblioteket bliev ikke fundet eller det var ikke tilladt at skrive til det.";
else $message = ($result)?"Filen er blevet uploadet." : "Der er sket en ukendt fejl.";
return $message;
}
?>
