Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Isn't Using the basename function with $_FILES['userFile']['name'] Redundant?

According to the POST method uploads section of the PHP Manual, $_FILES['userfile']['name'] is the original name of the file on the client machine. Example #2 in that section uses the basename function with $_FILES['userfile']['name'] like the following:

$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

I did some experiments on my local host (Apache 2.2.14, PHP 5.3.1, Windows XP) and found out that the following two lines are equivalent:

$_FILES['userFile']['name'];            // "file.txt"
basename($_FILES['userFile']['name']);  // "file.txt"

That is, using the basename function with $_FILES['userFile']['name'] seems rather redundant. Isn't it?

like image 498
Yaser Sulaiman Avatar asked Feb 27 '10 10:02

Yaser Sulaiman


2 Answers

That is, using the basename function with $_FILES['userFile']['name'] seems rather redundant. Isn't it?

No, first and foremost for security reasons as @Gumbo describes in his answer; secondly, because older versions of IE used to deliver the full path of the file on client side, like

C:\Documents and Settings\Username\Desktop\Image_cropped.jpg

that behaviour stopped as recently as IE8. From this MSDN blog entry discovered via this SO question:

File Upload control

Additionally, the “Include local directory path when uploading files” URLAction has been set to "Disable" for the Internet Zone. This change prevents leakage of potentially sensitive local file-system information to the Internet. For instance, rather than submitting the full path C:\users\ericlaw\documents\secret\image.png, Internet Explorer 8 will now submit only the filename image.png.

like image 182
Pekka Avatar answered Oct 19 '22 08:10

Pekka


HTTP requests can be forged and thus the filename provided in the header can also be manipulated.

If you want to ensure that only a filename is given, validate the value or filter it with basename to just get the filename.

like image 32
Gumbo Avatar answered Oct 19 '22 07:10

Gumbo