RE: PHP upload

From: Martin Svarovsky (martin.svarovsky@ileo.cz)
Date: 07. 02. 2003, 11:27 CET


> 1) Zaujimalo by ma (ako ochranu pred nejakym vtipalkom
> na pevnej linke), ci je mozne pred nahratim pomocou nejakeho 
> scriptu najprv zistit velkost suborov v cielovom adresari a ak 
> dosiahne nastavenu hodnotu, odmietnut upload.
> 2) Da sa dopredu otestovat velkost nahravaneho suboru, aby
> sa ta nastavena velkost nedala prekrocit nahratim jedneho 
> obrovskeho suboru?
> 
Dokud tam ten soubor nenahrajes tak PHPko nevi jak je velkej - takze se
to 100% odfiltrovat neda.
Muzes se branit dvema zpusoby:
1.) reknes browseru ze nema prijimat pro upload soubory vetsi nez X
bajtu:
---
<form enctype="multipart/form-data" action="_URL_" method="post"> 
<input type="hidden" name="MAX_FILE_SIZE" value="1000"> 
Send this file: <input name="userfile" type="file"> 
<input type="submit" value="Send File"> 
</form>
---

The _URL_ should point to a PHP file. The MAX_FILE_SIZE hidden field
must precede the file input field and its value is the maximum filesize
accepted. The value is in bytes. 

Warning: 
The MAX_FILE_SIZE is advisory to the browser. It is easy to circumvent
this maximum. So don't count on it that the browser obeys your wish! The
PHP-settings for maximum-size, however, cannot be fooled. 

2.) pokud mas pristup ke konfiguraci PHP (bezi to na tvem serveru),
muzes velikost uploadovaneho souboru upravit direktivou
"upload_max_filesize". Standardne je omezena na 2MB, coz by melo
zajistit tvoji situaci s limitem 100MB. Hosting na Globe.cz napr. tam
tuhle velikost nechal. Zjistit si to muzes pres phpinfo().

3.) pokud ti nastaveni velikosti v "upload_max_filesize" nevyhovuje (moc
velke), muzes jeste po uploadu odmitnout prekopirovat fajl - kontrolou
na "$soubor_size"

Martin



This archive was generated by hypermail 2.1.2 : 07. 02. 2003, 11:30 CET