How to prevent uploading fake images?

Question

Possible Duplicate:
How to check if an uploaded file is an image without mime type?
uploading, processing, storing and delivering user-provided files and images

i have image sharing script, i made half of it. the user can rename any php or cgi file to .jpg and upload it and it upload succfully

How to prevent uploading such fake images?

here is my way to check the file type

 $userfile_type = $_FILES['file']['type'];

and when i rename php file to php.jpg it can be uploaded easly.

kobino · Accepted Answer · 2012-12-21T14:24:08.813

3

// return mime type ala mimetype extension
$finfo = finfo_open(FILEINFO_MIME_TYPE);
    $type = finfo_file($finfo, $tmp_name);
finfo_close($finfo);

This is the server giving you the type of the file and not the browser as in your example.

With GD you can do something like getimagesize() which returns zero if the file is not an image

EDIT: "getimagesize is not a GD library function. It's native to PHP" Thanks Vivek

Happy coding !!

edited Dec 21 '12 at 14:24

answered Dec 21 '12 at 14:02

kobino

46
3

I use Imagemagic, any ideas ? thanks – Alamri Dec 21 '12 at 14:05
1

try with "exif_imagetype()", but some images don´t have exif data or in Imagemagick "Identify filename.png" – kobino Dec 21 '12 at 14:11
getimagesize is not a GD library function. It's native to PHP. – vivek Dec 21 '12 at 14:13
This is realy hard to avoid tho !!! a big newtwork i have got hacked cuz of this – Alamri Dec 21 '12 at 14:19

score 1 · Answer 2 · answered Dec 21 '12 at 14:00

1

Use imagemagic and check the image info

answered Dec 21 '12 at 14:00

Jimmy Kane

16,223
11
86
117

1

i use image magic, how to chech for image info type ? i got hacked because of this silly mistake – Alamri Dec 21 '12 at 14:06
http://php.net/manual/en/imagick.getimageproperties.php – Jimmy Kane Dec 21 '12 at 14:09

score 1 · Answer 3 · answered Dec 21 '12 at 14:02

1

One of the best ways of doing it is using http://php.net/manual/en/ref.fileinfo.php

answered Dec 21 '12 at 14:02

Sorin Trimbitas

1,467
18
35

score 1 · Answer 4 · answered Dec 21 '12 at 14:05

1

You can use getimagesize() to check for the image size. False is return if the function is not able to get the size. Even better if you can use GD library and use imagecreatefromstring() function to see whether it is a real image.

answered Dec 21 '12 at 14:05

vivek

1,944
1
17
26

NappingRabbit · Answer 5 · 2012-12-21T14:14:29.643

exif_imagetype()

php.net's example :

    if (exif_imagetype('image.gif') != IMAGETYPE_GIF) {
        echo 'The picture is not a gif';
    }

also this is directly from the php.net page I linked:

*If the function exif_imagetype() is not available; you can try the following workaround:*

if ( ! function_exists( 'exif_imagetype' ) ) {
    function exif_imagetype ( $filename ) {
        if ( ( list($width, $height, $type, $attr) = getimagesize( $filename ) ) !== false ) 
        {
            return $type;
        }
    return false;
    }
}

How to prevent uploading fake images?

5 Answers5