PHP文件上传检查finfo_file [英] PHP file upload check finfo_file

问题描述

我有一个可用的 PHP MIME 验证脚本来检查上传到网站的文件.问题在于当前的解决方案，可以轻松地将 dodgy.php 重命名为无害的.pdf，它将通过验证并上传...我想我需要使用 finfo_file PHP 5 逻辑来更精确地检查文件，但不是确定如何最好地将其集成到我当前的解决方案中......有什么建议吗?当前编码的解决方案如下，应该只允许上传 .doc、.docx 和 .pdf 文件:

I have a working PHP MIME validation script to check files that are uploaded to a website. Issue is with the current solution, that one can easily rename dodgy.php to become harmless.pdf and it will pass the validation and upload... I think I need to use the finfo_file PHP 5 logic to check the file more precisely but not sure on how best to integrate this to my current solution... Any advice? Current coded solution is as below, which should allow upload of just .doc, .docx and .pdf files:

$allowedExts = array(
  "pdf", 
  "doc", 
  "docx"
); 

$allowedMimeTypes = array( 
  'application/msword',
  'application/pdf',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
  'application/x-pdf',
  'application/vnd.pdf'
);

$extension = end(explode(".", $_FILES["fileinputFileName"]["name"]));

if ( ! ( in_array($extension, $allowedExts ) ) ) {
//throw error 
$hook->addError('fileinputFileName','Please ensure you select a PDF, DOC or DOCX file.');
return $hook->hasErrors();
}

if ( in_array( $_FILES["fileinputFileName"]["type"], $allowedMimeTypes ) ) 
{
// all OK - proceed     
return true; 
}
else
{
//throw error
$hook->addError('fileinputFileName','Please ensure you select a PDF, DOC or DOCX file.');
return $hook->hasErrors();
}

失败的代码示例:

$finfo = new finfo(FILEINFO_MIME_TYPE);
if (false === $ext = array_search(
    $finfo->file($_FILES["fileinputFileName"]["tmp_name"]),
    array(
        'doc' => 'application/msword',
        'pdf' => 'application/pdf',
        'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
        'pdf' => 'application/x-pdf',
        'pdf' => 'application/vnd.pdf'
    ),
    // all OK - proceed     
    return true; 
)) {
    //die('Please provide another file type [E/3].');
    $hook->addError('fileinputFileName','Please ensure you select a PDF, DOC or DOCX file.');
    return $hook->hasErrors();
}

推荐答案

正如您所提到的，依赖文件扩展名可能不是这里的最佳策略.相反，您可能想尝试使用 finfo 检测文件的 mimetype.来自 PHP 文档:

As you mention, relying on the file extension may not be the best strategy here. Instead, you may want to try to detect the mimetype of the file using finfo. From the PHP documentation:

// DO NOT TRUST $_FILES['upfile']['mime'] VALUE !!
// Check MIME Type by yourself.
$finfo = new finfo(FILEINFO_MIME_TYPE);
if (false === $ext = array_search(
    $finfo->file($_FILES['upfile']['tmp_name']),
    array(
        'jpg' => 'image/jpeg',
        'png' => 'image/png',
        'gif' => 'image/gif',
    ),
    true
)) {
    throw new RuntimeException('Invalid file format.');
}

http://php.net/manual/en/features.file-上传.php

这篇关于PHP文件上传检查finfo_file的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！