How to make a secure php image uploader?

views:

answers:

How to make a secure php image uploader?

I am making a PHP image uploader using the Zend Framework which will upload images to a public directory for people to be able to freely access.

I have so far implemented these measures for security: - File size validation - Extension validation - MimeType validation - Upon successful validation file is renamed with a image extension in a public folder, i.e. /images/uploads/...

Is this enough security? Can't run it through some antivirus script can you (is this required)?

The file extension and the mime type can be easily faked. Use getimagesize() to see if it really is an image.

Maerlyn 2010-08-21 08:20:51

That is the wrong solution IMO. It's possible to create a perfectly valid GIF image that is also a perfectly valid PHP script. You should toss out invalid image files just because they're invalid, but for security you should rely on proper server configurations. Don't let the server execute files in the public directory. Also, enforce proper file extensions for uploaded images (don't allow images called `image.gif.php`) and make sure that only `.php` files are processed by PHP (most servers are already setup correctly for this).

Lèse majesté 2010-08-21 08:30:40

For more information on the above exploit, see this link: http://www.phpclasses.org/blog/post/67-PHP-security-exploit-with-GIF-images.html

Lèse majesté 2010-08-21 08:32:25

Thank you for the info, I wasn't aware of that exploit.

Maerlyn 2010-08-21 08:54:37

File extension and mime type are being validated correctly through zend framework. Read the link, good security points, though as stated prior, my script renames files so not possible for image.gif.php etc to be saved onto server. A correct image extension is forced upon it. Though interesting that PHP can be embedded into gifs. I'm going to change my script to save files in non-public folder, and serve it via a php function to force a header and stop any possible execution of PHP script... Is a antivirus required? If I accepted executable files I would, but since its images is there any risk?

cappuccino 2010-08-21 09:06:19

If you do all that, then there should be no risk to you. Whether browsers or OSes have vulnerabilities in their GIF, JPEG or PNG renderers is a different matter, but that's not your problem to worry about. I wouldn't bother with an antivirus just for image files.

Lèse majesté 2010-08-21 10:17:39

@Lese majste hey how about posting all that as an answer. As it is, the only answer there is, is a poor one and I dont want to post mine since its pretty much what you wrote in your comments. :)

Iznogood 2010-08-21 17:04:52

ansaurus

tags:

views:

answers:

How to make a secure php image uploader?

related questions