I changed extension of text file to .jpg and tried to upload file. With IE7 mime type was recognized as text/plain and error "Mime Type mismatch" reported, but with Mozzila Firefox upload was completed.
imagefield: 5.x-2.x-dev
cck: 5.x-1.6-1
download method: public

CommentFileSizeAuthor
#2 New Text Document.jpg8 bytesbaja_tz

Comments

dopry’s picture

dopry commented

can you upload the image file you have trouble with here?

baja_tz’s picture

baja_tz commented
Status: Active » Postponed (maintainer needs more info)
StatusFileSize
new New Text Document.jpg8 bytes

This is ordinary txt file with changed extension to jpg. I'm concerned about it that someone can put anything with changed extension and it will be accepted like .bmp images which can't be resized. It's more problem in FF then in imagefield, because it doesn't read mime type. Little better solution is maybe to check first 8 bytes of file header like:

$uploaded_pic = fopen($file['filename'], "rb");
$header = fread($uploaded_pic, 8);
fclose ($uploaded_pic);
if (!strncmp ($uploaded_pic, "\xFF\xD8", 2))
        $extension = "JPEG";
etc...

This isn't safe also because anyone can change header. There is PEAR extension for cheking file types but I'm not sure
is it common that it is installed on web servers. And one proposal if I may, for beggining to add extra check in your code for bmp files, something like this:

if (strpos($file['filemime'], 'image/') !== 0 || strpos($file['filemime'], 'image/bmp') === 0 )

Thanks for reply and sorry about my english :)

dopry’s picture

dopry commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)

umm yeah you can put any extension on a file and upload it... we only check extension... browser mimes can be spoofed too. See the mimedetect.module if you want server side mime type detection. It however will not be integrated with imagefield.