TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 03-26-2008, 03:13 PM   #1 (permalink)
The Contributor
 
Join Date: Dec 2007
Posts: 31
Thanks: 0
TerrorRonin is on a distinguished road
Default Simple Image Uploader

I still see an abundance of image uploaded sites popping up.. so I got bored, and had a domain lying around, so I built a very simple application that people can use if they'd like.

A live (permanent) demo of the script is located at Free Image Hosting!

You can upload images there if you'd like, or you build your own, by using the source code shown below!
PHP Code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
    <title>Free Image Hosting!</title>
    <style type="text/css">
        body {
            margin: 0;
            padding: 50px 0 0;
            font-family: "Lucida Sans Unicode", Verdana, Arial, Sans-Serif;
            font-size: 11px;
        }
        
        a {
            color: #000000;
        }
        
        h1 {
            margin: 0;
            padding: 0;
        }
        
        h2 {
            margin: 10px 0;
            padding: 0:
            font-size: 12px;
        }
        
        #wrapper {
            background-color: #f0f0f0;
            border: 2px solid #d9d9d9;
            border-left: none;
            border-right: none;
            margin: 10px 0;
            padding: 10px;
            line-height: 25px;
            font-size: 12px;
        }
    </style>
</head>
<body><center>

    <?php
    
    $dir 
dirname(__FILE__) . '/uploads/';
    
    if (
is_dir($dir))
    {
        if (
$dh opendir($dir))
        {
            
$filecount '0';
            
            while ((
$file readdir($dh)) !== false)
            {
                if(!(
$file == '.' || $file == '..'))
                {
                    ++
$filecount;
                }
            }
            
closedir($dh);
            
            echo 
"\n";
        }
    }
    else
    {
        echo 
"You must create a /upload/ directory before this script will work.\n";
    }
    
    
?>
    <h1>Free Image Hosting!</h1>
    <div id="wrapper">
        <form method="post" enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>">
            Upload Image <input type="file" name="userfile" />
            <input type="submit" name="submit" value="Upload" />
        </form>
        <strong>Allowed Extensions:</strong> gif, jpg, bmp, png<br />
    </div>
    Currently Hosting <strong><?php echo $filecount?></strong> images!<br />
    
    <?php
    
        
if(isset($_POST['submit']))
        {
            if(
is_uploaded_file($_FILES['userfile']['tmp_name']))
            {
                if ((
$_FILES['userfile']['type']=="image/gif") || ($_FILES['userfile']['type']=="image/bmp") || ($_FILES['userfile']['type']=="image/pjpeg") || ($_FILES['userfile']['type']=="image/jpeg") || ($_FILES['userfile']['type']=="image/png") ) 
                {
                    
# // -- Upload Process Starts
                        
                    
$file '/uploads/' date('mdyhis') . '-' basename($_FILES['userfile']['name']);
                        
                    if (@
move_uploaded_file($_FILES['userfile']['tmp_name'], "./" $file))
                    {
                        
$url 'http://' $_SERVER['HTTP_HOST'] . $file;
                        
                        echo 
"<h2>File URL: <a href=\"{$url}\">{$url}</a></h2>\n";
                    }
                    else
                    {
                        echo 
"<h2>Unable to upload file to webserver, please verify that this directory exists</h2>\n";
                    }
                        
                    
# // -- Upload Process Ends
                
}
                else
                {
                    echo 
"<h2>Unacceptable File Type.  Please upload only as specified.</h2>\n";
                }
            }
        }
        else
        {
            echo 
"<h2></h2>\n";
        }
    
    
?>

</center>
</body>
</html>
If any of you have security fixes, or would like to add to this script, please do. I'll add any fixes that you like, etc.. maybe it can become a cool little script in the end :) I know it's not all that advanced right now, but this was just for fun :P
TerrorRonin is offline  
Reply With Quote
Old 03-26-2008, 04:25 PM   #2 (permalink)
The Wanderer
Good Samaritan 
 
martins256's Avatar
 
Join Date: Mar 2008
Posts: 18
Thanks: 0
martins256 is on a distinguished road
Default

$_FILES['userfile']['type'] is sent by the user thats uploads the file. you should check the file type with getimagesize()
martins256 is offline  
Reply With Quote
Old 03-26-2008, 05:12 PM   #3 (permalink)
The Contributor
 
Join Date: Dec 2007
Posts: 31
Thanks: 0
TerrorRonin is on a distinguished road
Default

Just add any fixes you have :D Sort of like an Open Source project :P
TerrorRonin is offline  
Reply With Quote
Old 03-26-2008, 07:06 PM   #4 (permalink)
The Acquainted
 
sjaq's Avatar
 
Join Date: Nov 2007
Location: Netherlands
Posts: 112
Thanks: 11
sjaq is on a distinguished road
Default

You should also check the extention, because someone could upload a valid image with some random php code at the end and your script will save it as .php so it will run. Don't have the time to fix this now but maybe later...
sjaq is offline  
Reply With Quote
Old 03-26-2008, 07:34 PM   #5 (permalink)
The Contributor
 
Join Date: Dec 2007
Posts: 31
Thanks: 0
TerrorRonin is on a distinguished road
Default

Yeah, i'd like to see you guys add to the code rather than just giving recommendations.. I want to see how you all would do it yourselves, so I can get hints in my future programming.
TerrorRonin is offline  
Reply With Quote
Old 06-16-2008, 05:01 PM   #6 (permalink)
The Wanderer
 
Join Date: Jun 2008
Location: Sweden
Posts: 9
Thanks: 3
Dezent is on a distinguished road
Default

Did anyone have the extention so you cant upload random php code ?
Send a message via MSN to Dezent
Dezent is offline  
Reply With Quote
Old 06-16-2008, 07:40 PM   #7 (permalink)
how quixotic are you?
 
ETbyrne's Avatar
 
Join Date: Dec 2007
Location: Lapeer, MI
Posts: 445
Thanks: 37
ETbyrne is on a distinguished road
Default

Use $filename = $_FILES['fieldname']['name']; to find the uploading file's name. Then just use
$filetype = explode('.', $filename);
$filetype = end($filetype);

to find the file exstention.

Also, please don't bump old topics.
__________________
Dingo Web Systems > http://www.dingocode.com
My Website > http://www.evanbot.com
ETbyrne is offline  
Reply With Quote
The Following User Says Thank You to ETbyrne For This Useful Post:
Dezent (06-17-2008)
Old 06-18-2008, 11:39 AM   #8 (permalink)
The Acquainted
 
EyeDentify's Avatar
 
Join Date: Nov 2007
Location: Sweden
Posts: 100
Thanks: 13
EyeDentify is on a distinguished road
Default

@TerrorRonin.

I get the lazy vibe from this post.

Why donīt you take the recommendations and change the code yourself?
__________________
Of course the whole point of a doomsday machine, would have been lost if you keep it a secret.
EyeDentify is offline  
Reply With Quote
Old 06-18-2008, 01:22 PM   #9 (permalink)
Moderateur
RegEx Guru PHP Guru Top Contributor Advanced Programmer 
 
Salathe's Avatar
 
Join Date: Apr 2007
Posts: 1,239
Thanks: 3
Salathe is on a distinguished road
Default

(Emphasis aded by Salathe)
Quote:
Originally Posted by TerrorRonin View Post
A live (permanent) demo of the script is located at Free Image Hosting!
It's probably a good job that your permanent demo isn't up there any more because it's a trivial matter to upload and execute arbitrary files (including but not limited to PHP files).
__________________
salathe@php.net
Salathe is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 02:38 AM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design