Question

I am working on a PHP upload script which allows uploading only PDF files. I am checking for the application/pdf MIME type before uploading. I have a PDF from my client that I am testing the upload script with and it is failing the upload error check and telling me that the file is a MIME type of application/download. I did download the PDF from the client via GMail. I also tested this with a PDF that I created in Photoshop and the script tells me that it is also of application/download type.

Here is how I am checking:

$mimeType = 'application/pdf';

if($_FILES[$filesName]['type'] != $mimeType)
{
  throw new UploadErrorException('File is not of correct type.');
}

I am trying to get the Fileinfo extension installed on my server (per grunk’s advice), but for now I am looking for something to work without it.

Any ideas? Thanks!

Answer 1

Your upload script allows any file type as long as the client says it’s PDF. Some browsers can not determine MIME types (duh, since determining MIME types is a hard problem) and just send a generic one. The correct way to check for the “real” MIME type is to use fileinfo.

If you don’t have fileinfo, use the following drop-in replacement (PDF only):

if (!class_exists('finfo')) {
  class finfo {
     function buffer($string) {
       switch (substr($string, 0, 4)) {
       case '%PDF': return 'application/pdf';
       default: return 'application/binary';
       }
     }
     function file($file_name, $options=0, $context=NULL) {
       $f = fopen($file_name, 'rb', false, $context);
       if ($f === false) return false;
       $magic = fread($f, 4);
       fclose($f);
       return $this->buffer($magic);
    }
  }
}
$finfo = new finfo();
echo $finfo->file('test.pdf');