From 03ddfbbaf1ba078df16638c642f8a3a9d8ca8c1c Mon Sep 17 00:00:00 2001 From: Fyorl Date: Fri, 15 Jun 2012 14:10:20 +0100 Subject: [ticket/10963] Modified filespec::is_image() to check actual mimetype Modified filespec::is_image() to check the Fileinfo mimetype rather than trusting the browser. PHPBB3-10963 --- phpBB/includes/functions_upload.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index f70e20e616..f3ae9d6cc4 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -151,7 +151,10 @@ class filespec */ function is_image() { - return (strpos($this->mimetype, 'image/') !== false) ? true : false; + $finfo = new finfo(FILEINFO_MIME_TYPE); + $mimetype = $finfo->file($this->filename); + + return (strpos($mimetype, 'image/') !== false) ? true : false; } /** @@ -342,6 +345,7 @@ class filespec // Remove temporary filename @unlink($this->filename); + $this->filename = $this->destination_file; if (sizeof($this->error)) { -- cgit v1.2.1 From f208b59c5984e686a3589eb83d5edb0b69bc020b Mon Sep 17 00:00:00 2001 From: Fyorl Date: Tue, 19 Jun 2012 13:27:27 +0100 Subject: [ticket/10963] Removed superfluous ternary statement and strpos now stricter PHPBB3-10963 --- phpBB/includes/functions_upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index f3ae9d6cc4..aedf361000 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -154,7 +154,7 @@ class filespec $finfo = new finfo(FILEINFO_MIME_TYPE); $mimetype = $finfo->file($this->filename); - return (strpos($mimetype, 'image/') !== false) ? true : false; + return (strpos($mimetype, 'image/') === 0); } /** -- cgit v1.2.1 From 4fbcf4eaadea0425c7f8bf0ff02a60bd2165136b Mon Sep 17 00:00:00 2001 From: Fyorl Date: Wed, 4 Jul 2012 13:27:55 +0100 Subject: [ticket/10963] filespec::get_mimetype now used filespec::get_mimetype now uses the finfo class in order to detect the mimetype of a given filename. filespec::is_image() now uses this method. PHPBB3-10963 --- phpBB/includes/functions_upload.php | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index aedf361000..33cb585b19 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -151,9 +151,7 @@ class filespec */ function is_image() { - $finfo = new finfo(FILEINFO_MIME_TYPE); - $mimetype = $finfo->file($this->filename); - + $mimetype = $this->get_mimetype($this->filename); return (strpos($mimetype, 'image/') === 0); } @@ -203,17 +201,12 @@ class filespec } /** - * Get mimetype. Utilize mime_content_type if the function exist. - * Not used at the moment... + * Get mimetype. Utilises the finfo class. */ function get_mimetype($filename) { - $mimetype = ''; - - if (function_exists('mime_content_type')) - { - $mimetype = mime_content_type($filename); - } + $finfo = new finfo(FILEINFO_MIME_TYPE); + $mimetype = $finfo->file($filename); // Some browsers choke on a mimetype of application/octet-stream if (!$mimetype || $mimetype == 'application/octet-stream') -- cgit v1.2.1 From 6aea4db6c7adbcee4fffa7cbc39564481fa6e211 Mon Sep 17 00:00:00 2001 From: Fyorl Date: Tue, 17 Jul 2012 17:36:09 +0100 Subject: [ticket/10944] Reverted changes in PHPBB3-10963 is_image now just checks the mimetype reported by the browser and get_mimetype goes back to being unused. PHPBB3-10944 --- phpBB/includes/functions_upload.php | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index 33cb585b19..f70e20e616 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -151,8 +151,7 @@ class filespec */ function is_image() { - $mimetype = $this->get_mimetype($this->filename); - return (strpos($mimetype, 'image/') === 0); + return (strpos($this->mimetype, 'image/') !== false) ? true : false; } /** @@ -201,12 +200,17 @@ class filespec } /** - * Get mimetype. Utilises the finfo class. + * Get mimetype. Utilize mime_content_type if the function exist. + * Not used at the moment... */ function get_mimetype($filename) { - $finfo = new finfo(FILEINFO_MIME_TYPE); - $mimetype = $finfo->file($filename); + $mimetype = ''; + + if (function_exists('mime_content_type')) + { + $mimetype = mime_content_type($filename); + } // Some browsers choke on a mimetype of application/octet-stream if (!$mimetype || $mimetype == 'application/octet-stream') @@ -338,7 +342,6 @@ class filespec // Remove temporary filename @unlink($this->filename); - $this->filename = $this->destination_file; if (sizeof($this->error)) { -- cgit v1.2.1 From e71474abb5e90d0aeee61d7d9a2d4648aed61426 Mon Sep 17 00:00:00 2001 From: Fyorl Date: Tue, 17 Jul 2012 17:39:19 +0100 Subject: [ticket/10944] strpos now stricter and removed superfluous ternary PHPBB3-10944 --- phpBB/includes/functions_upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index f70e20e616..d4c6b42cf4 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -151,7 +151,7 @@ class filespec */ function is_image() { - return (strpos($this->mimetype, 'image/') !== false) ? true : false; + return (strpos($this->mimetype, 'image/') === 0); } /** -- cgit v1.2.1 From 91b9cc90dd078fda135d975f0e5af798535d9014 Mon Sep 17 00:00:00 2001 From: Fyorl Date: Wed, 15 Aug 2012 15:00:03 +0100 Subject: [ticket/10939] Modified functions_upload to not use $_FILES PHPBB3-10939 --- phpBB/includes/functions_upload.php | 45 ++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 20 deletions(-) (limited to 'phpBB/includes/functions_upload.php') diff --git a/phpBB/includes/functions_upload.php b/phpBB/includes/functions_upload.php index d4c6b42cf4..b467aa93d1 100644 --- a/phpBB/includes/functions_upload.php +++ b/phpBB/includes/functions_upload.php @@ -566,10 +566,11 @@ class fileupload */ function form_upload($form_name) { - global $user; + global $user, $request; - unset($_FILES[$form_name]['local_mode']); - $file = new filespec($_FILES[$form_name], $this); + $upload = $request->file($form_name); + unset($upload['local_mode']); + $file = new filespec($upload, $this); if ($file->init_error) { @@ -578,9 +579,9 @@ class fileupload } // Error array filled? - if (isset($_FILES[$form_name]['error'])) + if (isset($upload['error'])) { - $error = $this->assign_internal_error($_FILES[$form_name]['error']); + $error = $this->assign_internal_error($upload['error']); if ($error !== false) { @@ -590,7 +591,7 @@ class fileupload } // Check if empty file got uploaded (not catched by is_uploaded_file) - if (isset($_FILES[$form_name]['size']) && $_FILES[$form_name]['size'] == 0) + if (isset($upload['size']) && $upload['size'] == 0) { $file->error[] = $user->lang[$this->error_prefix . 'EMPTY_FILEUPLOAD']; return $file; @@ -631,17 +632,17 @@ class fileupload */ function local_upload($source_file, $filedata = false) { - global $user; + global $user, $request; - $form_name = 'local'; + $upload = array(); - $_FILES[$form_name]['local_mode'] = true; - $_FILES[$form_name]['tmp_name'] = $source_file; + $upload['local_mode'] = true; + $upload['tmp_name'] = $source_file; if ($filedata === false) { - $_FILES[$form_name]['name'] = utf8_basename($source_file); - $_FILES[$form_name]['size'] = 0; + $upload['name'] = utf8_basename($source_file); + $upload['size'] = 0; $mimetype = ''; if (function_exists('mime_content_type')) @@ -655,16 +656,16 @@ class fileupload $mimetype = 'application/octetstream'; } - $_FILES[$form_name]['type'] = $mimetype; + $upload['type'] = $mimetype; } else { - $_FILES[$form_name]['name'] = $filedata['realname']; - $_FILES[$form_name]['size'] = $filedata['size']; - $_FILES[$form_name]['type'] = $filedata['type']; + $upload['name'] = $filedata['realname']; + $upload['size'] = $filedata['size']; + $upload['type'] = $filedata['type']; } - $file = new filespec($_FILES[$form_name], $this); + $file = new filespec($upload, $this); if ($file->init_error) { @@ -672,9 +673,9 @@ class fileupload return $file; } - if (isset($_FILES[$form_name]['error'])) + if (isset($upload['error'])) { - $error = $this->assign_internal_error($_FILES[$form_name]['error']); + $error = $this->assign_internal_error($upload['error']); if ($error !== false) { @@ -709,6 +710,7 @@ class fileupload } $this->common_checks($file); + $request->overwrite('local', $upload, phpbb_request_interface::FILES); return $file; } @@ -1001,7 +1003,10 @@ class fileupload */ function is_valid($form_name) { - return (isset($_FILES[$form_name]) && $_FILES[$form_name]['name'] != 'none') ? true : false; + global $request; + $upload = $request->file($form_name); + + return (!empty($upload) && $upload['name'] !== 'none'); } -- cgit v1.2.1