Witaj Gościu! ( Zaloguj | Rejestruj )

Forum PHP.pl

 
 Reply to this topicStart new topic
> uploadify skrypt (upload)
AndyPSV
post 4.04.2011, 05:46:22
Post #1





Grupa: Zarejestrowani
Postów: 393
Pomógł: 5
Dołączył: 6.02.2003
Skąd: The.Luciferian.Doctrine.p
df

Ostrzeżenie: (30%)
XX---

Uzywam skryptu JQUERY: uploadify
1. Problem polega na tym, ze nie chce uploadowac plikow z nazwa: "dowolna_nazwajpg.JPG"
2. jak zabezpieczyc go przed uploadem plikow o roznych rozszerzeniach?
3. jest problem, bo nie wiadomo jak wyswietlic KOD (tzn. bledy) tego skryptu php

jakby ktos mogl rzucic okiem i poprawic, dziekowalbym

---

[PHP] pobierz, plaintext 
  1. <?php
  2.  
  3. /* SECURITY HOLE: USER CAN UPLOAD FILES TO OTHER USER IF HE WANTS TO HACK SOMETHING; practically: low priority, nobody would engage in such action; BUT IT NEEDS TO BE FIXED */
  4. /* DON'T UPLOADS PARTICULAR IMAGES WITH "NAMES" DIFFERENT */
  5.  
  6. include($_SERVER['DOCUMENT_ROOT'].'/libs/db/index.php'); include($_SERVER['DOCUMENT_ROOT'].'/libs/db/db.php'); if(!ctype_digit($_GET['id'])) die('!ctype_digit'); include($_SERVER['DOCUMENT_ROOT'].'/libs/url/index.php'); define('N','/');
  7. $q = q('SELECT t,t2 FROM `'.PRFX.'cfg_en` WHERE id = 1'); if(n_r($q) == 0) die('no cfg'); $cfg = f($q);
  8. $q = q('SELECT * FROM `'.PRFX.'ads` WHERE id = "'.$_GET['id'].'" LIMIT 1'); if(n_r($q) == 0) die(H.'no ad'); $r = f($q); /*include($_SERVER['DOCUMENT_ROOT'].'/libs/auth/index.php'); $u = isUlogd($cfg['t2']); if($u['id'] <> $r['u']) die(H.'u <> usr [you\'re trying to edit somebody\'s ad; no permission]');*/ $r['t_'] = _url($r['t']);
  9.  
  10.  
  11. if(!empty($_FILES)) {
  12. 	/****
  13. 	 * GALERIE TWORZY mozliwa jest ona do edycji
  14. 	 * musi poczekac [3] KOMPRESUJE PLIK, AUTOMATYCZNIE I TWORZY MINIATURE (TZW FACEBOOK SIZE)
  15. 	 * 90%; stala wielkosc watermarka (ale to punkt [3] musi byc zrobiony)||||||dodaje watermark na srodku obrazka albo gdzies po boku z ID obrazka (id ogloszenia)
  16. 	 * 90% done, but it needs to change the thumbnail (image resized) value [2] sprawdza czy nie wystepuje juz plik o tej samej tzw. checksum; jesli wystepuje to go nie uploaduje
  17. 	 * 90% [zrobione] [1] tworzy folder osobny (do jednego folderu z ID wrzuca) dla kazdego dodanego zdjecia; na kazde 5 000 subfolderow jest jeden znowu podkatalog ||||| w nieskonczona petle wrzucic
  18. 	 * przy kasowaniu zdjec automatyczne usuwanie ich z bazy i z serwera; jak skasuje wszystkie to tez automatycznie usuwa folder
  19. 	 * [czeka na punkt [3]]mozliwosc tworzenia miniatury ze zdjecia (czyli inne)
  20. 	 * SIZE_LIMIT for all images and documents (1MB, 20MB) or maybe not do it for the photos (but up to 5mb);
  21. 	 */
  22. 	$range = 5000;/* UNCHANGEABLE VALUE! */ $sub_dir = ceil($r['id']/$range); $targetPath = $_SERVER['DOCUMENT_ROOT'].N.'i'.N.$sub_dir.N.$r['id'].N;
  23.  
  24. 	/** HERE IS SECURITY HOLE: VERIFY DO I CAN UPLOAD ANY SCRIPTS WITH .php or any other extensions not allowed anywhere in script **/
  25. 	$fileTypes  = str_replace('*.','',$_REQUEST['fileext']); $fileTypes  = str_replace(';','|',$fileTypes); $typesArray = split('\|',$fileTypes); $fileParts  = pathinfo($_FILES['Filedata']['name']);
  26.  
  27. 	#$q = q('SELECT id FROM `'.PRFX.'ads_files` WHERE checksum = "'.md5_file($_FILES['Filedata']['tmp_name']).'" AND id_ = "'.$r['id'].'" LIMIT 1'); if(n_r($q) == 0) {
  28. 		q('INSERT INTO `'.PRFX.'ads_files` (id_,descr,th) VALUES ("'.$r['id'].'","","")'); $filename = $r['t_'].',(www.'.$cfg['t'].',ID#'.$r['id'].'),'.l_id().'.'.$fileParts['extension'];
  29. 		q('UPDATE `'.PRFX.'ads_files` SET t = "'.$filename.'" WHERE id = "'.l_id().'"');
  30. 		/* '.md5_file($_FILES['Filedata']['tmp_name']).' DON'T DO CHECKSUMS, IF USER WOULD FIND A DUPLICATE [doesn't check] HE WOULD DELETE IT; INSTEAD A FILENAME WOULD BE PUT, BECAUSE IT WAS BE USED TO DON'T READ ALL THE TIME FOLDERS (lower server usage) */
  31. 		$targetFile = str_replace('//','/',$targetPath).basename($filename);
  32.  
  33. 		if(in_array($fileParts['extension'],$typesArray)) {
  34. 			mkdir(str_replace('//','/',$targetPath),0755,true); move_uploaded_file($_FILES['Filedata']['tmp_name'],$targetFile);
  35.  
  36. 			include($_SERVER['DOCUMENT_ROOT'].'/libs/watermark/index.php'); if($fileParts['extension'] == 'gif' OR $fileParts['extension'] == 'jpeg' OR $fileParts['extension'] = 'png' OR $fileParts['extension'] = 'jpg')
  37. 				imagewatermark($targetFile,$_SERVER['DOCUMENT_ROOT'].'/libs'.N.'watermark/watermark.png',65);
  38.  
  39. 			switch($_FILES['Filedata']['error']) {
  40. 				case 1: die('The file is bigger than this PHP installation allows'); break;
  41. 				case 2: die('The file is bigger than this form allows'); break;
  42. 				case 3: die('Only part of the file was uploaded'); break;
  43. 				case 4: die('No file was uploaded'); break;
  44. 				case 6: die('Missing a temporary folder'); break;
  45. 				case 7: die('Failed to write file to disk'); break;
  46. 				case 8: die('File upload stopped by extension'); break;
  47. 				default: die('unknown error '.$_FILES['Filedata']['error']);
  48. 			} echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile);
  49. 		} else die(H.'Invalid file type');
  50. 	#}
  51. }
  52.  
  53. ?>
[PHP] pobierz, plaintext


pozmienialem pare rzeczy zarowno w kodzie .html (na slepo) jak i w kodzie php i dziala biggrin.gif

[PHP] pobierz, plaintext 
  1. <?php
  2.  
  3. /* SECURITY HOLE: USER CAN UPLOAD FILES TO OTHER USER IF HE WANTS TO HACK SOMETHING; practically: low priority, nobody would engage in such action; BUT IT NEEDS TO BE FIXED */
  4. /* DON'T UPLOADS PARTICULAR IMAGES WITH "NAMES" DIFFERENT */
  5.  
  6. include($_SERVER['DOCUMENT_ROOT'].'/libs/db/index.php'); include($_SERVER['DOCUMENT_ROOT'].'/libs/db/db.php'); if(!ctype_digit($_GET['id'])) die('!ctype_digit'); include($_SERVER['DOCUMENT_ROOT'].'/libs/url/index.php'); define('N','/');
  7. $q = q('SELECT t,t2 FROM `'.PRFX.'cfg_en` WHERE id = 1'); if(n_r($q) == 0) die('no cfg'); $cfg = f($q);
  8. $q = q('SELECT * FROM `'.PRFX.'ads` WHERE id = "'.$_GET['id'].'" LIMIT 1'); if(n_r($q) == 0) die(H.'no ad'); $r = f($q); /*include($_SERVER['DOCUMENT_ROOT'].'/libs/auth/index.php'); $u = isUlogd($cfg['t2']); if($u['id'] <> $r['u']) die(H.'u <> usr [you\'re trying to edit somebody\'s ad; no permission]');*/ $r['t_'] = _url($r['t']);
  9.  
  10.  
  11. if(!empty($_FILES)) {
  12. 	/****
  13. 	 * GALERIE TWORZY mozliwa jest ona do edycji
  14. 	 * musi poczekac [3] KOMPRESUJE PLIK, AUTOMATYCZNIE I TWORZY MINIATURE (TZW FACEBOOK SIZE)
  15. 	 * 90%; stala wielkosc watermarka (ale to punkt [3] musi byc zrobiony)||||||dodaje watermark na srodku obrazka albo gdzies po boku z ID obrazka (id ogloszenia)
  16. 	 * 90% done, but it needs to change the thumbnail (image resized) value [2] sprawdza czy nie wystepuje juz plik o tej samej tzw. checksum; jesli wystepuje to go nie uploaduje
  17. 	 * 90% [zrobione] [1] tworzy folder osobny (do jednego folderu z ID wrzuca) dla kazdego dodanego zdjecia; na kazde 5 000 subfolderow jest jeden znowu podkatalog ||||| w nieskonczona petle wrzucic
  18. 	 * przy kasowaniu zdjec automatyczne usuwanie ich z bazy i z serwera; jak skasuje wszystkie to tez automatycznie usuwa folder
  19. 	 * [czeka na punkt [3]]mozliwosc tworzenia miniatury ze zdjecia (czyli inne)
  20. 	 * SIZE_LIMIT for all images and documents (1MB, 20MB) or maybe not do it for the photos (but up to 5mb);
  21. 	 */
  22. 	$range = 5000;/* UNCHANGEABLE VALUE! */ $sub_dir = ceil($r['id']/$range); $targetPath = $_SERVER['DOCUMENT_ROOT'].N.'i'.N.$sub_dir.N.$r['id'].N;
  23.  
  24. 	/** HERE IS SECURITY HOLE: VERIFY DO I CAN UPLOAD ANY SCRIPTS WITH .php or any other extensions not allowed anywhere in script **/
  25. 	$fileTypes  = str_replace('*.','',$_REQUEST['fileext']); $fileTypes  = str_replace(';','|',$fileTypes); $typesArray = split('\|',$fileTypes); $fileParts  = pathinfo(strtolower($_FILES['Filedata']['name']));
  26.  
  27. 	#$q = q('SELECT id FROM `'.PRFX.'ads_files` WHERE checksum = "'.md5_file($_FILES['Filedata']['tmp_name']).'" AND id_ = "'.$r['id'].'" LIMIT 1'); if(n_r($q) == 0) {
  28. 		q('INSERT INTO `'.PRFX.'ads_files` (id_,descr,th) VALUES ("'.$r['id'].'","","")'); $filename = $r['t_'].',(www.'.$cfg['t'].',ID#'.$r['id'].'),'.l_id().'.'.$fileParts['extension'];
  29. 		q('UPDATE `'.PRFX.'ads_files` SET t = "'.$filename.'" WHERE id = "'.l_id().'"');
  30. 		/* '.md5_file($_FILES['Filedata']['tmp_name']).' DON'T DO CHECKSUMS, IF USER WOULD FIND A DUPLICATE [doesn't check] HE WOULD DELETE IT; INSTEAD A FILENAME WOULD BE PUT, BECAUSE IT WAS BE USED TO DON'T READ ALL THE TIME FOLDERS (lower server usage) */
  31. 		$targetFile = str_replace('//','/',$targetPath).basename($filename);
  32.  
  33. 		if(in_array($fileParts['extension'],$typesArray)) {
  34. 			mkdir(str_replace('//','/',$targetPath),0755,true); move_uploaded_file($_FILES['Filedata']['tmp_name'],$targetFile);
  35.  
  36. 			include($_SERVER['DOCUMENT_ROOT'].'/libs/watermark/index.php'); if($fileParts['extension'] == 'gif' OR $fileParts['extension'] == 'jpeg' OR $fileParts['extension'] = 'png' OR $fileParts['extension'] = 'jpg')
  37. 				imagewatermark($targetFile,$_SERVER['DOCUMENT_ROOT'].'/libs'.N.'watermark/watermark.png',65);
  38.  
  39. 			switch($_FILES['Filedata']['error']) {
  40. 				case 1: die('The file is bigger than this PHP installation allows'); break;
  41. 				case 2: die('The file is bigger than this form allows'); break;
  42. 				case 3: die('Only part of the file was uploaded'); break;
  43. 				case 4: die('No file was uploaded'); break;
  44. 				case 6: die('Missing a temporary folder'); break;
  45. 				case 7: die('Failed to write file to disk'); break;
  46. 				case 8: die('File upload stopped by extension'); break;
  47. 				default: die('unknown error '.$_FILES['Filedata']['error']);
  48. 			} echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile);
  49. 		} else die(H.'Invalid file type');
  50. 	#}
  51. }
  52.  
  53. ?>
[PHP] pobierz, plaintext
Go to the top of the page
+Quote Post
« Następny starszy · PHP · Następny nowszy »
 

Reply to this topicStart new topic
1 Użytkowników czyta ten temat (1 Gości i 0 Anonimowych użytkowników)
0 Zarejestrowanych:

 

Tryb wyświetlania: Przełącz na: Standardowy · Linearny+ · Przełącz na: Drzewo

Śledź ten temat · Wyślij temat na e-mail · Wydrukuj ten temat · Subskrybuj to forum

RSS Wersja Lo-Fi Aktualny czas: 14.08.2025 - 11:18
Powered By IP.Board © 2025  IPS, Inc.
All changes by PHP.pl Administrators
Hosting zapewnia NQ.pl hosting, trac, svn