Page 1 of 1

unexpected file type during upload

Posted: Mon Apr 19, 2010 9:44 pm
by yacahuma
I am uploading a pdf and I am getting this on the $_FILES array

Array
(
[userfile] => Array
(
[name] => diyautoparts.pdf
[type] => application/force-download
[tmp_name] => C:\Windows\Temp\phpFD61.tmp
[error] => 0
[size] => 40449
)

)
I was expecting application/pdf. Can someone explain? Thank you

Re: unexpected file type during upload

Posted: Mon Apr 19, 2010 9:53 pm
by Benjamin
I would assume that the variable comes from the browser and therefore cannot be relied on.

Re: unexpected file type during upload

Posted: Tue Apr 20, 2010 3:42 am
by requinix
Benjamin wrote:I would assume that the variable comes from the browser and therefore cannot be relied on.
Yes. Yes yes yes. Very yes.

Re: unexpected file type during upload

Posted: Tue Apr 20, 2010 3:23 pm
by yacahuma
What are the alternatives? I now there is fileinfo in 5.3 But I dont have 5.3 available

Re: unexpected file type during upload

Posted: Tue Apr 20, 2010 5:13 pm
by requinix
5.3 merely has fileinfo built-in. You can still get it separately for PHP <5.3.

Re: unexpected file type during upload

Posted: Tue Apr 20, 2010 5:43 pm
by yacahuma
how?

Re: unexpected file type during upload

Posted: Tue Apr 20, 2010 5:56 pm
by Eran

Re: unexpected file type during upload

Posted: Wed Apr 21, 2010 3:24 am
by JAY6390
Never rely on the mime types given for uploaded files since with header injection its possible to change them to whatever a hacker wants to