Uploading .tmp file instead of desired file to server - php

Question

I am working on uploading a file to box.net.
I am sending the file using Curl,
But the problem i am facing is it does not upload the file I selected, Instead it uploads some .tmp file.
following is my code:
<?php
$upload_url = 'Server-Url';
$tmpfile = $_FILES['new_file1']['tmp_name'];
$_POST['new_file1'] = '#'.$tmpfile;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $upload_url);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $_POST);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
?>
<form action=""
enctype="multipart/form-data" accept-charset="utf-8" method="POST">
<input type="file" name="new_file1" />
<input type="text" name="share" value="1" />
<input type="submit" name="upload_files" value="Upload File" />
</form>
Am i doing some thing wrong?
Please can any one help me out to solve this problem.

Answer 1

tmp_name is supposed to contain a temporary name. The actual file name is in the name element. See the manual.
However, with the code you have, if you use the name element, you introduce a huge vulnerability into your code, as an attacker may be able to make your script upload local files from your server. Use move_uploaded_file() to prevent that.

Answer 2

As far as I've seen curl does not offer to choose one file yet send a different name for it during upload. Unless you want to craft the whole HTTP request yourself to allow you for this flexibility, you'll have to rename the file on disk to give it the right name. Renaming a file to an arbitrary user-provided name is always a giant security risk though. Below I'm creating a unique temporary directory and am double-checking that the file will be moved into that directory to avoid path injection attacks and to avoid overwriting other files. There may or may not be more attack vectors I'm not thinking about though!
do {
$tmpDir = sys_get_temp_dir() . DIRECTORY_SEPARATOR . uniqid('upload');
} while (file_exists($tmpDir));
$uploadFile = realpath($tmpDir . DIRECTORY_SEPARATOR . basename($_FILES['new_file1']['name']));
if (strpos($uploadFile, $tmpDir) !== 0) {
trigger_error('File path not within expected directory', E_USER_ERROR);
exit;
}
mkdir($tmpDir, 0600);
move_uploaded_file($_FILES['new_file1']['tmp_name'], $uploadFile);
...
curl_setopt($ch, CURLOPT_POSTFIELDS, array('file' => "#$uploadFile"));
...
unlink($uploadFile);
rmdir($tmpDir);