Page 1 of 1

Browser not writing $_FILES['..']['tmp_name']?

Posted: Wed Nov 29, 2006 9:09 pm
by LiveFree
Hey All,

Got sort of a weird problem here. I've wirtten my own file upload class file but Ive been finding that my browser (Firefox 1.5 on Linux) is not sending the tmp_name or my script just isnt recieving it.

Im accessing the $_FILES array correctly and using move_uploaded_file() with an absolute path, everything is normal there but here's the print_r:

Code: Select all

locahost/File Upload/upload/images.zip

Array
(
    [file] => Array
        (
            [name] => images.zip
            [type] => 
            [tmp_name] => 
            [error] => 2
            [size] => 0
        )

)
The path at the top is my upload dir + file

And the upload form:

Code: Select all

<form enctype="multipart/form-data" action="upload.php" id="form" method="post">
	<input type="hidden" name="MAX_FILE_SIZE" value="3000" />	
	File: <input type="file" name="file" size="50" /><br />
	<a href='javascript:void(0)' onclick="window.open('style/emailhelp.htm', '')">Email (Optional)</a>: <input type='text' name='email' id='email' size='50' /><br />

	By uploading your file, you agree to our <a href="docs.php?doc=tos">terms of service</a>. <br /><input type="submit" value="Upload" id="upload" /></form>
Thanks

Posted: Wed Nov 29, 2006 10:39 pm
by volka
The browser never sets the tmp_name element, server-side php does.
LiveFree wrote:[error] => 2
http://www.php.net/manual/en/features.file-upload.errors.php wrote:UPLOAD_ERR_FORM_SIZE

Value: 2; The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.
LiveFree wrote:<input type="hidden" name="MAX_FILE_SIZE" value="3000" />

Posted: Thu Nov 30, 2006 3:09 am
by dibyendrah
Does

Code: Select all

<input type="hidden" name="MAX_FILE_SIZE" value="3000" />
this override the value of php.ini

Code: Select all

; Maximum allowed size for uploaded files.
upload_max_filesize = 2M
?

Posted: Thu Nov 30, 2006 5:13 am
by Skittlewidth
No, I believe it just prevents the form from submitting a file over that size.

Posted: Thu Nov 30, 2006 6:40 am
by volka
The client/browser does not care about the name="MAX_FILE_SIZE" field (at least I don't know a browser that does. My Firefox certainly doesn't).
PHP checks that value. It does not overwrite upload_max_filesize, both values are checked. But since MAX_FILE_SIZE is sent by the client along with the payload it's not trustworthy, do not rely on that feature.

Posted: Fri Dec 01, 2006 1:57 am
by dibyendrah
volka wrote:The client/browser does not care about the name="MAX_FILE_SIZE" field (at least I don't know a browser that does. My Firefox certainly doesn't).
PHP checks that value. It does not overwrite upload_max_filesize, both values are checked. But since MAX_FILE_SIZE is sent by the client along with the payload it's not trustworthy, do not rely on that feature.
Okay. So, what is the use of "MAX_FILE_SIZE" in file upload ? I also don't rely in this feature and just validate the size using server side features.

Posted: Fri Dec 01, 2006 1:48 pm
by feyd
Some browsers specify what the size of the file being sent is in the request headers. PHP can filter the file in this manor so that neither party wastes bandwidth they don't need to because the file is beyond acceptable limitations. As previously said, you still need to check the error flag and size fields to verify, but that should be standard procedure for everyone, shouldn't it? ;)

Posted: Sat Dec 02, 2006 7:06 am
by dibyendrah
Okay, I found the error flags on the PHP manual which I didn't notice before.

Code: Select all

$_FILES['userfile']['error']. 

UPLOAD_ERR_OK
Value: 0; There is no error, the file uploaded with success. 

UPLOAD_ERR_INI_SIZE
Value: 1; The uploaded file exceeds the upload_max_filesize directive in php.ini. 

UPLOAD_ERR_FORM_SIZE
Value: 2; The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form. 

UPLOAD_ERR_PARTIAL
Value: 3; The uploaded file was only partially uploaded. 

UPLOAD_ERR_NO_FILE
Value: 4; No file was uploaded. 

UPLOAD_ERR_NO_TMP_DIR
Value: 6; Missing a temporary folder. Introduced in PHP 4.3.10 and PHP 5.0.3. 

UPLOAD_ERR_CANT_WRITE
Value: 7; Failed to write file to disk. Introduced in PHP 5.1.0.