Question

I have the following PHP code

// Check if the upload is setted
if
(
    isset($_FILES['file']['name']) && !empty($_FILES['file']['name']) && 
    isset($_FILES['file']['type']) && !empty($_FILES['file']['type']) &&
    isset($_FILES['file']['size']) && !empty($_FILES['file']['size'])
)
{
    $UploadIsSetted = true;
    $UploadIsBad = false;

    $UploadExtension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);

    // Check if the upload is good
    require "../xdata/php/website_config/website.php";
    $RandomFoo = rand(1000999999,9999999999);

    if (($_FILES["file"]["size"] < ($MaxAvatarPictureSize*1000000)))
    {
        if ($_FILES["file"]["error"] > 0)
        {
            $UploadIsBad = true;
            $hrefs->item(0)->setAttribute("Error","true");
            $hrefs->item(0)->setAttribute("SomethingWrong","true");
        }
        else
        {
            move_uploaded_file($_FILES["file"]["tmp_name"],"../upload/tmp/".$RandomFoo.".file");    
        }
    }
    else
    {
        // The file is too big
        $UploadIsBad = true;
        $hrefs->item(0)->setAttribute("Error","true");
        $hrefs->item(0)->setAttribute("UploadTooBig","true");
    }
}
else
{
    $UploadIsSetted = false;
}

$ZipFile = new ZipArchive;
$ZipFile->open('../upload/tmp/'.$LastFilename.'.zip',ZIPARCHIVE::CREATE);
$ZipFile->addFile('../upload/tmp/'.$RandomFoo.'.file',$RandomFoo.".".$UploadExtension);
$ZipFile->close();

now my big concern is that user can upload anything so how can i prevent :

• uploading 2GB 3GB files
• floading
• uploading some kind of twisted exploit that would eventually alter my server security
• buffer overflow
• filenames that have arbitrary code injections

i mean, how secure is this script?

i’m running windows for now, i will switch to linux

Answer 1

Four your other questions:

floading

That’s the complex part. Let me google you some ideas:

• Prevent PHP script from being flooded
• Quick and easy flood protection? – use a nonce, time+tie it onto a session
• Use a captcha, if it doesn’t impair usability too much.

uploading some kind of twisted exploit that would eventually alter my server
security

Use a commandline virus scanner (f-prot or clamav) to scan uploaded files. You might use a naive regex scanner in PHP itself (probe for HTMLish content in image files, e.g.), but that’s not a factual security feature; don’t reinvent the wheel.

buffer overflow

PHP in general is not susceptible to buffer overflows.

Okay, joking. But you can’t do anything in userland about it. But pushing strings around isn’t much of a problem. That’s pretty reliable and unexploitable in scripting languages, as long as you know how to escape what in which context.

filenames that have arbitrary code injections

At the very leat you should most always use basename() to avoid path traversal exploits. If you want to keep user-specified filenames, a regex whitelist is in order. =preg_replace('/[^\w\s.]/', '', $fn) as crude example.