Allowing certain file types?

Aug 6, 2014 10:24 PM

So I have a code here and I want to know what do you think I should add
To make it so only certain file types are allowed:

Code 
<?php

    $files = @$_FILES["files"];

    if ($files["name"] != '.php') {

        $fullpath = $_REQUEST["path"] . $files["name"];

        if (move_uploaded_file($files['tmp_name'], $fullpath)) {

            echo "<h1><a href='$fullpath'>Direct Link to your file</a></h1>";

echo "URL: <input type=text name=1 class=code onClick='this.select()' size=50 value='http://hostbb.org/" . $siteurl . "/" . $fullpath . "'></h1>";

        }

    }echo '<html><head><title>HostBB - Free Direct File Hosting</title></head><body><form method=POST enctype="multipart/form-data" action=""><input type="file" name="files"><input type=submit value="Upload"></form><br><br>

<a href="tos.php"><font face="system" color="white">Terms Of Service</a> | <a href="report.php"><font face="system" color="white">Report A file</a></body></html>';

    ?>

I have tried a few ways but failed. Also, if I could make it so if its a php file instead of executing it downloads.

Aug 7, 2014 04:58 PM

(Aug 7, 2014 10:17 AM)AppleJuice Wrote: The way I do this, is to have a whitelist. All filename extensions must be in a whitelist, if it is not the file will not upload. For extra security measures, I have a second whitelist that allows certain file MIME types to be uploaded.

A simple approach can be done like this.

PHP Code
<?php if (isset($_FILES['files']) && !empty($_FILES['files'])) { $files = $_FILES['files']; if (preg_match("/\.(jpe?g|png|gif|zip|tar|gz|rar|txt|log|mp3|wav|wmv|mov|mp4)$/", $files['name'])) { $fullpath = $_REQUEST['path'] . $files['name']; if (move_uploaded_file($files['tmp_name'], $fullpath)) { echo "<h1><a href='$fullpath'>Direct Link to your file</a></h1>"; echo "URL: <input type=text name=1 class=code onClick='this.select()' size=50 value='http://hostbb.org/" . $siteurl . "/" . $fullpath . "'></h1>"; } } } echo '<html><head><title>HostBB - Free Direct File Hosting</title></head><body><form method=POST enctype="multipart/form-data" action=""><input type="file" name="files"><input type=submit value="Upload"></form><br><br> <a href="tos.php"><font face="system" color="white">Terms Of Service</a> | <a href="report.php"><font face="system" color="white">Report A file</a></body></html>';

As well, why are you using $_REQUEST? And why are you using a request variable part of the file path? I find that a bit of a security issue.

For some extra security, you should put a maximum file size when uploading. And you should remove the PHP and CGI handlers on certain files (.php, .phtml, .php5, .pl, .py, .cgi, etc) using HTACCESS and then deny access to all files that are not in the allowed file extensions list.

Thanks for that. Anyway I do have htacces allowing only certain types so if you upload PHP files you get an error. The same is with HTML I prevent the execution of both extensions. However they can still download it.

Aug 7, 2014 08:16 PM

(Aug 7, 2014 06:22 PM)AppleJuice Wrote: Deny access to the files then, as I have said. Please us show your htaccess?

Deny all access to everything except the files we allow. Put this in an htaccess inside your uploads folder.

Code
Order deny,allow Deny from all <FilesMatch "\.(png|jpe?g|gif|zip|tar|rar|txt)$"> Allow from all </FilesMatch>

Code 
<Files *.html>

    Order Deny,Allow

    Deny from all

    Allow from 127.0.0.1

</Files>

<Files */>

    Allow from all

</Files>

<Files *.php>

    Order Deny,Allow

    Deny from all

    Allow from 127.0.0.1

</Files>

<Files index.php>

    Order Allow,Deny

    Allow from all

</Files>

<Files tos.php>

    Order Allow,Deny

    Allow from all

</Files>

<Files report.php>

    Order Allow,Deny

    Allow from all

</Files>

<Files beta.php>

    Order Allow,Deny

    Allow from all

</Files>

<Files up.php>

    Order Allow,Deny

    Allow from all

</Files>

Aug 7, 2014 09:08 PM

Done that it looks all good so far

Thanks for that

Aug 8, 2014 04:44 PM

(Aug 8, 2014 04:41 PM)Forezza Wrote: Isn't that just checking if .jpg, .png, etc... are in the name of the file? That would be a bit of a security concern as people could just upload image.jpg.php.

What would you suggest? Also I have my htaccess set to only being able to execute allowed files.

Login
Username/Email:
Password:	Lost Password?
	Remember me

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
[PHP] Only allowing admin user types to access admin page by ~RexonApr 28, 2017 01:45 PM	24	697	Apr 28, 2017 01:45 PM Last Post: elunez
[PHP] Shell Allowing FTP Access? by Haters Ganna HateJun 29, 2012 06:09 AM	5	112	Jun 29, 2012 06:09 AM Last Post: Eight
[PHP] [Script]List files inside a folder with icons associated to file types by username.txtMay 11, 2012 06:41 PM	1	84	May 11, 2012 06:41 PM Last Post: DAVEologist