views:

351

answers:

2

Hey. This code works in most browsers, and even partially in IE6. It uploads files less 10Mb (approximately), but not anything larger. The code specifies that those files are permitted.

Also, note that it seems like the entire file seems to be transferred to the servers before disregarded.

The website is at: www.mgxvideo.com/mgxcopy-alpha-3/ and can be reached by adding an item in the cart, and then clicking the upload function. Ideas?

Here is the form:

<form enctype="multipart/form-data" action="upload_files.php?order_id=<?php echo $_GET['order_id'] ?>" method="POST">
    <table style="width:100%">
        <tr>
         <td valign="top">
          <span class="style1">Choose a file to upload: </span> 
         </td>
         <td valign="top">
          <input name="uploadedfile" type="file" />
         </td>
        </tr>
    </table>
    <input type="submit" value="Upload File" />
    <input type="hidden" name="action" value="add"/>
    <input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
</form>

Here is a line at the top of upload_files.php:

$upload_output = upload_file($customer_id, $_REQUEST['action'], $_GET['order_id'], $_FILES);

And here is the upload_file() code:

function upload_file($customer_id, $action, $upload_id, $FILES)
{
 $target_path = "uploads/";

 $target_path = $target_path . $customer_id . '_' . $upload_id . '_' . basename( $FILES['uploadedfile']['name']); 
 $str_output = '';

 if ($action == 'del' and file_exists($_POST['filepath']))
 {
  delete_file($customer_id, $_POST['filepath']);
  $str_output = '<span class="style1">File successfully deleted. If you are done uploading files, ' .
    '<a href="#" onclick="self.close();">click here</a> to close this window.</span>';
  setcookie("upload_out_txt", $str_output, time() + 300);
  setcookie("upload_out_b", "1", time() + 300);
 } else if ($action == 'add')
 {
  if (count_uploads($customer_id, $upload_id) >= 2)
  {
   $str_output = '<span class="style1">Problem: You have reached the maximum allowed uploads for this particular order. Please delete a file before continuing.</span>';
   setcookie("upload_out_txt", $str_output, time() + 300);
   setcookie("upload_out_b", "1", time() + 300);
  } else if (file_exists($target_path))
  {
   $str_output = '<span class="style1">Problem: A version of the file you are trying to upload already exists. Please delete the file from out servers before uploading again.</span>';
   setcookie("upload_out_txt", $str_output, time() + 300);
   setcookie("upload_out_b", "1", time() + 300);
  } else if (move_uploaded_file($FILES['uploadedfile']['tmp_name'], $target_path)) 
  {
   insert_to_database('uploaded_files', array($customer_id, $upload_id, 'now()', $target_path));
   $str_output = '<span class="style1">Success. The file was successfully uploaded. If you are done, <a href="" onclick="window.close();">click here to close the window</a></span>';
   setcookie("upload_out_txt", $str_output, time() + 300);
   setcookie("upload_out_b", "1", time() + 300);
  } else
  {
   $str_output = '<span class="style1">There was an error uploading the file, please try again!</span>';
   setcookie("upload_out_txt", $str_output, time() + 300);
   setcookie("upload_out_b", "1", time() + 300);
  }
 }



 return $str_output;
}

Here is my php.ini file, after I tried to implement a fix:

extension_dir="/kunden/homepages/30/d93769495/htdocs/extensions";
extension=uploadprogress.so;
upload_max_filesize=150M;
post_max_size=210M;
max_input_time=1800;
file_uploads=1;
memory_limit=240M;
max_execution_time=1800;
+2  A: 

This may not fix it but on one thread i was reading it said that IE6 needs to process the MAX_FILE_SIZE line before the filename input. So try moving the following line to the top of the form:

<input type="hidden" name="MAX_FILE_SIZE" value="100000000" />

I have no idea if it works and IE6 requires it to be parsed in that order, but that is what the thread I was reading said the solution was.

Also check your php.ini max file size and timeout.

Sean A.O. Harney
changed but to no avail
montooner
The `MAX_FILE_SIZE` has absolutely no effect on the client. In fact, you could just remove it.
Andrew Moore
True, it seems that no browser pays any attention to it.From some forum I was reading:"The MAX_FILE_SIZE hidden field (measured in bytes) must precede the fileinput field, and its value is the maximum filesize accepted. This is anadvisory to the browser, PHP also checks it. Fooling this setting on thebrowser side is quite easy, so never rely on files with a greater sizebeing blocked by this feature."
Sean A.O. Harney
+1  A: 

Check the following settings in php.ini:

  1. upload_max_filesize needs to be greater than 10 MiB (10M).

  2. post_max_size needs to be at least 40% greater than upload_max_filesize.

    The reason why this is required is that some old user-agents will upload using base64 encoding, which adds a 37% overhead to the data. Add mime headers, other post parameters, there are plenty of reasons to have it higher than upload_max_filesize.

  3. max_input_time needs to be at least 900 (15 minutes).

    You want to give enough time for the user to upload its file.

Andrew Moore
nah, doesn't work either.
montooner
**@montooner:** You might need to restart Apache after your configuration changes.
Andrew Moore