使用PHP上传DOC或PDF

Question

我可以很好地上传图像,但是当我将图像/ jpg,image/gif更改为application/msword和application/pdf时,它不起作用.这是我的代码.完全相同的代码适用于图像,但是对于上传文档和pdf,它会输出"无效文件".这里发生了什么？我的文件只有大约30kb,远低于文件大小限制.

$allowedExts = array("pdf", "doc", "docx"); 
$extension = end(explode(".", $_FILES["file"]["name"]));

if ( ( ($_FILES["file"]["type"] == "application/msword") || ($_FILES["file"]["type"] == "text/pdf") ) 
&& ($_FILES["file"]["size"] < 20000) && in_array($extension, $allowedExts))
{      
 move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); 
}
else
{
echo "Invalid file."
}

Answer 1

请勿使用该['type']参数来验证上传.该字段是用户提供的,可以简单地伪造,允许上传任何类型的文件.这同样适用于在['name']参数-这是由用户提供的文件的名称.伪造也是微不足道的,因此用户发送nastyvirus.exe和调用它cutekittens.jpg.

验证上传的正确方法是使用服务器端mime类型确定,例如通过fileinfo,以及正确的上传成功检查,您不需要:

if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    die("Upload failed with error " . $_FILES['file']['error']);
}
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
$ok = false;
switch ($mime) {
   case 'image/jpeg':
   case 'application/pdf'
   case etc....
        $ok = true;
   default:
       die("Unknown/not permitted file type");
}
move_uploaded_file(...);

您还使用用户提供的文件名作为move_uploaded_files的最终目标的一部分.将路径数据嵌入到该文件名中也是微不足道的,然后您可以盲目地使用它.这意味着恶意远程用户可以在服务器上的任何文件上涂鸦,他们知道路径,以及工厂新文件.

Answer 2

请在代码中添加正确的mime类型 - 至少这些:

.jpeg -> image/jpeg
.gif  -> image/gif
.png  -> image/png

可以在此处找到mime类型列表.

此外,简化代码的逻辑并报告错误编号,以帮助第一级支持追踪问题:

$allowedExts = array(
  "pdf", 
  "doc", 
  "docx"
); 

$allowedMimeTypes = array( 
  'application/msword',
  'text/pdf',
  'image/gif',
  'image/jpeg',
  'image/png'
);

$extension = end(explode(".", $_FILES["file"]["name"]));

if ( 20000 < $_FILES["file"]["size"]  ) {
  die( 'Please provide a smaller file [E/1].' );
}

if ( ! ( in_array($extension, $allowedExts ) ) ) {
  die('Please provide another file type [E/2].');
}

if ( in_array( $_FILES["file"]["type"], $allowedMimeTypes ) ) 
{      
 move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); 
}
else
{
die('Please provide another file type [E/3].');
}

Answer 3

$folder = "Resume/";
$temp = explode(".", $_FILES["uploaded"]["name"]);
$newfilename = round(microtime(true)).'.'. end($temp);
$db_path ="$folder".$newfilename  ;
//remove the .
$listtype = array(
'.doc'=>'application/msword',
'.docx'=>'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
'.rtf'=>'application/rtf',
'.pdf'=>'application/pdf'); 
if ( is_uploaded_file( $_FILES['uploaded']['tmp_name'] ) )
{
if($key = array_search($_FILES['uploaded']['type'],$listtype))
{if (move_uploaded_file($_FILES['uploaded']  ['tmp_name'],"$folder".$newfilename))
{
include('connection.php');
$sql ="INSERT INTO tb_upload
(filePath) VALUES ('$db_path')";
}
}
else    
{
echo "File Type Should Be .Docx or .Pdf or .Rtf Or .Doc";
}