Error with file upload as base64 encoded string - php

Question

I want to receive an image from an android device, which is sending an image as a Base64 encoded string. This is my controller action code:
public function Upload()
{
if ($this->request->is('post')) {
$dir= APP.'outsidefiles'; //chane directory for cloud
$fill = $this->request->data['File'] ;
$data = base64_decode($fill);
$im = imagecreatefromstring($data);
if ($im !== false)
{
$nam ='mypic.png';
move_uploaded_file($im['tmp_name'],$dir.DS.time().$nam);
}
//$dir= APP . 'outsidefiles';
// $this->request->data['Grade']['Fila']= $File;
$this->Grade->create();
if ($this->Grade->save($this->request->data))
{
$return = array(
'Response' =>'1',
'Body' => 'Data Saved');
return new CakeResponse(array('body' => json_encode($return, JSON_NUMERIC_CHECK)));
}
else
{
$return = array(
'Response' =>'0',
'Body' => 'Data not saved');
return new CakeResponse(array('body' => json_encode($return, JSON_NUMERIC_CHECK)));
}
}
}
However the image is not created in the destination folder - what is the error?

Answer 1

move uploaded file is for moving uploaded files
This will not work:
move_uploaded_file("I am not a file upload" , "/put/file/here/path.png");
It won't work even if the first argument points at a file because, as stated in the documentation:
If filename is not a valid upload file, then no action will occur, and move_uploaded_file() will return FALSE.
This prevents this kind of naïve attack from working:
// User input is not safe, it could be e.g.:
$_FILES['example']['tmp_name'] = '/etc/passwd';
...
move_uploaded_file(
$_FILES['example']['tmp_name'],
"/web/accessible/location/now-public.txt"
);
image create from string does not return an array
This also won't work:
$im = imagecreatefromstring($data);
$im['tmp_name']; <-
As, the return value from this function is an image resource, not an array. tmp_name related to file uploads - there is no actual file upload if it is being submitted as a base64 encoded string; it's just a string.
To upload a base64 encoded string means only creating a file
The logical steps required are not related to file uploads at all, only writing a binary string to a file i.e.:
$data = base64_decode($fill);
file_put_contents('/tmp/pic.png', $data);