TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 09-29-2007, 08:07 AM   #1 (permalink)
The Acquainted
 
Join Date: Sep 2007
Posts: 126
Thanks: 4
Sam Granger is on a distinguished road
Default checking file extensions. How can I change this?

Code:
	function checkFileExtentions(form){
		if(check_file_extentions == false){ return false; }
		var re = /(\.php)|(\.sh)$/i;
		if(form['filename'].value != ""){
			if(form['filename'].value.match(re)){
				var string = form['filename'].value;
				var num_of_last_slash = string.lastIndexOf("\\");
				if(num_of_last_slash < 1){ num_of_last_slash = string.lastIndexOf("/"); }
				var file_name = string.slice(num_of_last_slash + 1, string.length);
				var file_extention = file_name.slice(file_name.indexOf(".")).toLowerCase(); 
				alert('Sorry, uploading a file with the extention "' + file_extention + '" is not allowed.');
				return true;
			}
		}
		return false;
	}
I have the following js code. At the moment, it warns me if I want to upload a php file. How can I make it warn me for all file extensions, with the exception of .jpg? :confused:
Sam Granger is offline  
Reply With Quote
Old 10-01-2007, 02:28 PM   #2 (permalink)
The Contributor
 
mortisimus's Avatar
 
Join Date: Sep 2007
Location: London, UK
Posts: 47
Thanks: 4
mortisimus is on a distinguished road
Default

Looks like it will warn you every time. I'm no good at javascript but maybe do a check for something like:

if (file ext. doesn't equal jpg){
alert("error!");
}
else
{
//carry on with upload or whatever...
}

sorry but I do not know the right js code to put in...
mortisimus is offline  
Reply With Quote
Old 10-01-2007, 03:05 PM   #3 (permalink)
Moderateur
RegEx Guru PHP Guru Top Contributor Advanced Programmer 
 
Salathe's Avatar
 
Join Date: Apr 2007
Posts: 1,393
Thanks: 5
Salathe is on a distinguished road
Default

Code:
// Returns true if the extension is invalid
function checkFileExtentions(form)
{
	if (check_file_extentions == false)
	{
		return false;
	}
	
	// Regex of valid extensions
	var re = /\.(jpg|jpeg|png|gif|bmp)$/i
	
	// If we have a filename to check and it is invalid
	if (form['filename'].value != '' && !form['filename'].value.match(re))
	{
		var name = form['filename'].value;
		var ext  = name.substr(name.lastIndexOf('.')+1).toLowerCase();
		alert('Sorry, uploading a file with the extention "' + ext + '" is not allowed.');
		return true;
	}
	
	return false;
}
Salathe is offline  
Reply With Quote
Old 10-03-2007, 03:31 PM   #4 (permalink)
The Acquainted
 
Join Date: Sep 2007
Posts: 126
Thanks: 4
Sam Granger is on a distinguished road
Default

Thanks Salathe! That code of yours worked like a dream!
Sam Granger is offline  
Reply With Quote
Old 10-03-2007, 03:32 PM   #5 (permalink)
Moderateur
RegEx Guru PHP Guru Top Contributor Advanced Programmer 
 
Salathe's Avatar
 
Join Date: Apr 2007
Posts: 1,393
Thanks: 5
Salathe is on a distinguished road
Default

You're most welcome, I'm here to help. :)
Salathe is offline  
Reply With Quote
Old 12-09-2007, 04:51 PM   #6 (permalink)
The Contributor
RegEx Guru 
 
Join Date: Dec 2007
Location: Belgium
Posts: 60
Thanks: 6
Geert is on a distinguished road
Default

The "jpg" and "jpeg" extensions can be merged into one alternation option, which should be faster.
Code:
/\.(jpe?g|png|gif|bmp)$/i
Also, since you're not using the captured parentheses, make them non-capturing, which should be faster.
Code:
/\.(?:jpe?g|png|gif|bmp)$/i
__________________
Kohana - PHP5 framework
Geert is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 03:44 AM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design