Re: [PHP] Trapping for PDF Type and file size in a UPLOAD form...

On 29/07/10 19:10, tedd wrote:
> At 9:50 AM -0700 7/29/10, Don Wieland wrote:
>> I am trying to create an UPLOAD form and need to figure a way to only
>> allow PDF files to be selected.
>
> The short answer is you can't -- not from php. You can create a standard
> form and upload it from there, but you don't have control over file type.
>
> So you can't stop people from uploading anything to your site via the
> form, but you can look at the document once it's there and inspect it.
> Using a HEX Editor, I see that most pdf file have the first four bytes
> as "%PDF" so you might check that before moving the file to somewhere
> important. But that doesn't stop spoofing.
>
> Other than that, I can't see any way to do it.
>
> Cheers,
>
> tedd

Second what tedd says, with a bit more: on a Linux backend system I run uploaded 
files through the 'file' command with a decent magic file to detect the file 
type. I also run every upload through a virus scanner (clamscan, for example) 
before I accept it.
If your PHP backend is windows then you might need to do some research to find a 
good file-type detection routine, although the virus scanning should be possible.

You certainly cannot trust the client side to do any checking. In any case, 
JavaScript doesn't (shouldn't) have access to the file you are trying to upload, 
so there's not much you can do there. You might achieve something client-side 
with Flash, or a Java uploader applet, I suppose.

Cheers
Pete

-- 
Peter Ford, Developer                 phone: 01580 893333 fax: 01580 893399
Justcroft International Ltd.                              www.justcroft.com
Justcroft House, High Street, Staplehurst, Kent   TN12 0AH   United Kingdom
Registered in England and Wales: 2297906
Registered office: Stag Gates House, 63/64 The Avenue, Southampton SO17 1XS