Expand |
Embed | Plain Text
Comments
Subscribe to comments
You need to login to post a comment.
Hey there. Just noticed that the script is killed on line 10 if '..' is detected in the filename string. As such, line #11's overhead is redundant — the condition will not be met.
Since ereg is being phased out for PHP6 you should use preg_match, and you should be checking it on a per path chunk basis, ie:
$targetArray = explode('/',$filename); foreach($targetArray as $key => $value){ if(preg_match('/^(..|.ht).*/',$value){ die('File Path Invalid'); } }
What if i have a file in: ficheros/images/picture.htc.jpg or ficheros/filename..doc?
Also if you are not subdirectorying you could just use basename($filename) and be done with it
Since ereg is being phased out for PHP6 you should use preg_match, and you should be checking it on a per path chunk basis, ie:
$targetArray = explode('/',$filename); foreach($targetArray as $key => $value){ if(preg_match('/^(..|.ht).*/',$value){ die('File Path Invalid'); } }
What if i have a file in: ficheros/images/picture.htc.jpg or ficheros/filename..doc?
Also if you are not subdirectorying you could just use basename($filename) and be done with it
lastly i fine it thanks
Why, don't you check the CodeIgniter download helper it has logic if we are dealing with Internet Explorer or other browser and it's probably more tested than this code. The function name is force_download
Nice snippet but you should replace the function "eregi()"
from the PHP manual: This function has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.