Uploading a non-image file and sending image type mime

PHP programming forum. Ask questions or help people concerning PHP code. Don't understand a function? Need help implementing a class? Don't understand a class? Here is where to ask. Remember to do your homework!

Moderator: General Moderators

Post Reply
User avatar
anjanesh
DevNet Resident
Posts: 1679
Joined: Sat Dec 06, 2003 9:52 pm
Location: Mumbai, India

Uploading a non-image file and sending image type mime

Post by anjanesh »

According to the PHP Manual :
$_FILES['userfile']['type']
The mime type of the file, if the browser provided this information. An example would be "image/gif".

So how do I get to change that ?
I want upload a php file and have to browser send a mime type of image/jpeg. Is that possible ?
User avatar
Chris Corbyn
Breakbeat Nuttzer
Posts: 13098
Joined: Wed Mar 24, 2004 7:57 am
Location: Melbourne, Australia

Post by Chris Corbyn »

Would you mind if I ask why?

You wont be able to change anything the browser send but I guess you can overwrite it on the server side. (Not tested though).

Otherwise, just hard-code it if you're always gonna use image/jpeg ;)
User avatar
anjanesh
DevNet Resident
Posts: 1679
Joined: Sat Dec 06, 2003 9:52 pm
Location: Mumbai, India

Post by anjanesh »

Assuming I have no access to the server.
I upload an image which is allowed. It is obviously checked on the server side for $_FILE['userfile']['type'] to see if its and image type.
I want to upload a php file (.php) and send the mime as image so that it gets accepted on the server.
Is this possible ?

The last option is change the source of FF and send it like this but Im looking for a direct method.
User avatar
Chris Corbyn
Breakbeat Nuttzer
Posts: 13098
Joined: Wed Mar 24, 2004 7:57 am
Location: Melbourne, Australia

Post by Chris Corbyn »

If you're using windows I believe simply changing the extension to .jpg will do it. You'll just have to rename it again on the server.

I don't know why the host blocks PHP files though...
User avatar
anjanesh
DevNet Resident
Posts: 1679
Joined: Sat Dec 06, 2003 9:52 pm
Location: Mumbai, India

Post by anjanesh »

Im using Win XP but Apache 2.x - I think Apache handles this stuff and not the OS ?
Tried to upload a test.php but doesnt get accepted - the code checks like this :

Code: Select all

if (substr($_FILES['userfile']['type'][$i],0,5)!="image") {return 1;}
Renamed test.php to test.jpg and test.php.jpg and gets accpeted but the image doesnt show. Instead the entire php code is the source (when right-clicked in FF) and gives the error :
The image “http://localhost/xxx/test.php.jpg” cannot be displayed, because it contains errors.
I want to upload an image which gets accepted that contains this :

Code: Select all

<?php
header("Content-type: image/jpeg");
$Image = @imagecreatetruecolor(100,50);
// Create my dynamic image
@imagejpeg($Image);
?>
hongco
Forum Contributor
Posts: 186
Joined: Sun Feb 20, 2005 2:49 pm

Post by hongco »

anjanesh wrote:Im using Win XP but Apache 2.x - I think Apache handles this stuff and not the OS ?
Tried to upload a test.php but doesnt get accepted - the code checks like this :

Code: Select all

if (substr($_FILES['userfile']['type'][$i],0,5)!="image") {return 1;}
Renamed test.php to test.jpg and test.php.jpg and gets accpeted but the image doesnt show. Instead the entire php code is the source (when right-clicked in FF) and gives the error :
The image “http://localhost/xxx/test.php.jpg” cannot be displayed, because it contains errors.
I want to upload an image which gets accepted that contains this :

Code: Select all

<?php
header("Content-type: image/jpeg");
$Image = @imagecreatetruecolor(100,50);
// Create my dynamic image
@imagejpeg($Image);
?>
The browser got fooled and thought it was an image file, but on the server side, your file's actual header is not.

If you can somehow make your php work right after being uploaded, I guest youcould read the server's security info ;)

.. not sure if this link helps:
viewtopic.php?t=33208
User avatar
anjanesh
DevNet Resident
Posts: 1679
Joined: Sat Dec 06, 2003 9:52 pm
Location: Mumbai, India

Post by anjanesh »

hongco wrote:The browser got fooled and thought it was an image file, but on the server side, your file's actual header is not.
Actually this is not because of the browser - its because Apache didn't get that file parsed - it doesnt parse .php.jpg or .jpg files containing php code - it sends the entire contents directly.
User avatar
phpScott
DevNet Resident
Posts: 1206
Joined: Wed Oct 09, 2002 6:51 pm
Location: Keele, U.K.

Post by phpScott »

that's because to the server the ext .jpg is an image and .php is a php file, providing there server understands .php ext.

I'll ask agian why do you want to fool the server in this way?

if you had access to the server you get .jpg to be interpreted as php but that would ruin the .jpg's that are actually images.
User avatar
m3mn0n
PHP Evangelist
Posts: 3548
Joined: Tue Aug 13, 2002 3:35 pm
Location: Calgary, Canada

Post by m3mn0n »

There is a reason why sites only allow specific MIME types. PHP can read/remove/move files that the owner does not want people to read/remove/move.

If you want to upload a PHP file that will generate an image, just run the script and upload the jpeg yourself.
Post Reply