Will this only allow certain extensions? - php

Question

I found this snippet that says will only allow certain file types. Will it work and could someone bypass it to upload what ever file type they want? And could someone explain the substr part, i don't get how it works..
<?php
function CheckExt($filename, $ext) {
$name = strtolower($filename);
if(substr($name, strlen($name) -3, 3) == $ext)
return true;
else
return false;
}
?>

Answer 1

A better way to check extensions
function checkExt($filename, $ext)
{
$fnExt = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if(!is_array($ext)) {
$ext = (array)$ext;
}
$ext = array_map('strtolower', $ext);
return in_array($fnExt, $ext);
}
You can then call it like
var_dump(checkExt('test.temp', 'tmp')); // false
var_dump(checkExt('test.temp', array('tmp', 'temp'))); // true
Avoid using substr as the extension length is unknown (you can use substr & strrpos as well but php provides this functionality for you)

Answer 2

It's very easy to bypass as changing the extension of a file does not change the contents of the file. So a .exe renamed into a .jpg is still an .exe waiting to be run anyway. You can use it for a basic check, but don't rely solely on it to validate file types.
This substr() call:
substr($name, strlen($name) -3, 3)
Is better more simply written as:
substr($name, -3)
Which PHP just interprets as 'take only the last 3 characters of $name'.
EDIT: it's not better per se because file extensions don't necessarily have to be 3 characters long. They could be 2, they could be 4, 5, even 10. This is why as I said, checking file extensions isn't very reliable.

Answer 3

I prefer to whitelist the Mimetypes I want to allow using something along the lines of
$mimesGeneral = array(
'txt'=>'text/plain',
'doc'=>'application/msword',
'pdf'=>'application/pdf',
'xls'=>'application/x-excel',
'xls'=>'application/excel',
'xls'=>'application/vnd.ms-excel',
'rtf'=>'application/rtf',
'zip'=>'application/zip'
);
$success = false;
foreach($allowedMimes as $key=>$value){
if($_FILES['uploaded_file']['type'] == $value){
return true;
}
}
I use this with a blacklist of suffixes e.g 'php', 'pl', 'exe' etc...

Answer 4

People will still be able to upload whatever they want; they just have to give the file a particular extension.
For substr, see the manual.