Question

Basically the following for the core part:

$file = basename($_GET['f']);
$directory = "/var/www/site/";
$file = $directory . $file;
$hash = $_GET['h'];
$md5check = md5($file);
$md5check = substr($md5check, 0, 5);

if ($md5check == $hash) {
    if (file_exists($file)) {
        unlink($file);
    }
    else {
        die('error');
    }
}
else {
    header('Location: error');
    exit;
}

I realise using the users input is asking for trouble, but how can I get the server to ‘locate’ the file to delete? Am I somehow able to escape injections?
The user would be loading http://site.com/?f=test.jpg&h=hashc

Also is there any other hash systems besides MD5 which is separate for each location of a file?
eg.

file1.rar downloaded at 12:00am = differenthash
file1.rar downloaded at 11:00pm = randomhash
file1.rar is the same file in both scenarios.

versus md5:
file1.rar downloaded at 12:00am = randomhash
file1.rar downloaded at 11:00pm = randomhash
file1.rar is the same file in both scenarios.

Answer 1

You’re already using basename which should limit the attack vector greatly (as the user can’t delete files from a different directory), however letting the user have access to delete files from /var/ is a very bad idea as the user would be able to pass any non-image file across too.

Can you not have some path relative to your web root rather than a very important system directory?

Extra security could include (note that this list is not at all exhaustive..):

1. User checking: Check that the web server user owns the file the user is requesting to delete.
2. Store uploaded files in the database and check that they exist and have been uploaded by our script before allowing deletion.
3. As above, move the files out of the system directory.
4. Use stronger hashing (ie. salts!).
5. Restrict this to a logged in user and log all actions, if somebody tries to delete a file it’s logged and you know exactly who it was.