Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:3663
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <3F293786.6090002@php.net>
Date: Thu, 31 Jul 2003 17:36:38 +0200
User-Agent: Mozilla/5.0 (X11; U; Linux i686; de-AT; rv:1.4) Gecko/20030617
MIME-Version: 1.0
To: skate <root@fatcuban.com>
CC: Rasmus Lerdorf <rasmus@lerdorf.com>,  internals@lists.php.net
References: <059101bffadb$28a33670$1400000a@fatcuban> <Pine.WNT.4.56.0307310738380.2248@DELL> <005201c35777$6812e7a0$1400000a@fatcuban>
In-Reply-To: <005201c35777$6812e7a0$1400000a@fatcuban>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] upload compromises
From: hartmut@php.net (Hartmut Holzgraefe)

skate wrote:
> well, i was more thinking of, by default, only allowing say images,
> documents and compressed files.
> [...] 
> i can fully understand that determining an executable is a mean task, and
> way out of the scope for what PHP needs to be. 

there are more image and document formats around than there are
executable file formats i guess ...

> but PHP already has the in
> built functionality to check a file type, same way as i would check a file
> when i have an upload script.

it is not really builtin, at least not enabled by default, and last time i
looked at it was even labled EXPERIMENTAL AFAIR (and i have to know ;)

> i just think that if there's a default setting, it'll cure a lot of the
> problems we get with un-educated users created wild upload scripts. most
> things can be dangerous in one form or another, but would taking a few steps
> like this really be more effort than it's worth?

i see your point, but checking the file type is only half of it as e.g.
M$Word documents may contain VBA macro viruses. so to really make sure
that no unwanted stuff gets uploaded you also need to apply virus checking
and stuff like that ...

-- 
Hartmut Holzgraefe  <hartmut@php.net>