1

My image upload seems OK to me while I test for accepting only jpg/jpeg file types, but somehow users manage to upload even png file types and the image turns black.

Can you see where am I wrong?

my html

<div class="row form-group"><img id="output" class="imgoutput wdt" />
  <div class="col-md-12"><label for="activities">Please attach your photo
      (250x250)</label> <input id="file" class="form-control" accept=".jpg,
      .jpeg" name="file" type="file" /></div>
</div>

Here is error handling

if($_FILES['file']['size'] == '0'){
            $error[] = 'Please attach your photo.';
        }elseif($_FILES["file"]["size"] > 2097152){
            $error[] = 'Selected image size is too large, upload under 2mb.';
        }elseif(!in_array($_FILES["file"]["type"], array("image/jpg", "image/jpeg"))){
            $error[] = 'We accept only (JPG / JPEG) image file type.';
        }

and here is when the image is uploaded

if($_FILES['file']['name']!='')
            {
                $tmp_name = $_FILES["file"]["tmp_name"];
                $namefile = $_FILES["file"]["name"];
                $cname = str_replace(' ', '-', $candidate_name);
                $ext = end(explode(".", $namefile));
                $fileUpload = move_uploaded_file($tmp_name,"uploads/images/".$image_name);
                $image_name= $cname.'-'.time().".".$ext;                
                resize_image($tmp_name,"uploads/images/".$image_name);
                $img = ''.$image_name.'';
            }

What looks wrong here that few users manages to select and get png image to be uploaded?

RamblinRose
  • 4,883
  • 2
  • 21
  • 33
Roselyn
  • 11
  • 1
  • MIME types can be spoofed by a knowledgeable user. So perhaps that is what happened to you. More info: https://stackoverflow.com/questions/8028184/mime-type-spoofing , and https://security.stackexchange.com/questions/35933/how-can-i-spoof-the-mimetype-of-a-file-upload (and elsewhere online). You could try also checking the file extension to make it slightly more difficult for someone to spoof, but again there's nothing to stop someone changing the file extension either. There's no efficient & foolproof way to prevent this, you can only make it so it's a PITA for people to cheat. – ADyson Apr 27 '20 at 14:21

0 Answers0