PHP video upload and checking video type

Question

I created my upload file with video size and type validation. Only webm, mp4 and ogv file types are allowed and 2gb file size max. My php code:

if (isset($_POST['submit']))
{
    $file_name = $_FILES['file']['name'];
    $file_type = $_FILES['file']['type'];
    $file_size = $_FILES['file']['size'];

    $allowed_extensions = array("webm", "mp4", "ogv");
    $file_name_temp = explode(".", $file_name);
    $extension = end($file_name_temp);
    
    $file_size_max = 2147483648;
    if (!empty($file_name))
    {
        if (($file_type == "video/webm") || ($file_type == "video/mp4") || ($file_type == "video/ogv") &&
            ($file_size < $file_size_max) && in_array($extension, $allowed_extensions))
        {
            if ($_FILES['file']['error'] > 0)
            {
                echo "Unexpected error occured, please try again later.";
            } else {
                if (file_exists("secure/".$file_name))
                {
                    echo $file_name." already exists.";
                } else {
                    move_uploaded_file($_FILES["file"]["tmp_name"], "secure/".$file_name);
                    echo "Stored in: " . "secure/".$file_name;
                }
            }
        } else {
            echo "Invalid video format.";
        }
    } else {
        echo "Please select a video to upload.";
    }
}

My html code:

<form action="upload_file.php" method="post" enctype="multipart/form-data">
<input type="file" name="file"><br />
<input type="submit" name="submit" value="Submit">
</form>

I'am always getting "Invalid video format.". I downloaded webm, mp4 and ogv video files from flowplayer website to test my little upload script.

http://stream.flowplayer.org/bauhaus/624x260.webm
http://stream.flowplayer.org/bauhaus/624x260.mp4
http://stream.flowplayer.org/bauhaus/624x260.ogv

Answer 1

Your extensions were not correctly being validated.. try this

if (isset($_POST['submit']))
{
    $file_name = $_FILES['file']['name'];
    $file_type = $_FILES['file']['type'];
    $file_size = $_FILES['file']['size'];

    $allowed_extensions = array("webm", "mp4", "ogv");
    $file_size_max = 2147483648;
    $pattern = implode ($allowed_extensions, "|");

    if (!empty($file_name))
    {    //here is what I changed - as you can see above, I used implode for the array
        // and I am using it in the preg_match. You pro can do the same with file_type,
        // but I will leave that up to you
        if (preg_match("/({$pattern})$/i", $file_name) && $file_size < $file_size_max)
        {
            if (($file_type == "video/webm") || ($file_type == "video/mp4") || ($file_type == "video/ogv"))
            {
                if ($_FILES['file']['error'] > 0)
                {
                    echo "Unexpected error occured, please try again later.";
                } else {
                    if (file_exists("secure/".$file_name))
                    {
                        echo $file_name." already exists.";
                    } else {
                        move_uploaded_file($_FILES["file"]["tmp_name"], "secure/".$file_name);
                        echo "Stored in: " . "secure/".$file_name;
                    }
                }
            } else {
                echo "Invalid video format.";
            }
        }else{
            echo "where is my mojo?? grrr";
        }
    } else {
        echo "Please select a video to upload.";
    }
}