<?php
include "./_common.php";
$isUpload = is_uploaded_file($_FILES['SummernoteFile']['tmp_name']);
// SUCCESSFUL
if($isUpload) {
$ym = date('ym', G5_SERVER_TIME);
$data_dir = G5_DATA_PATH.'/editor/'.$ym;
$data_url = G5_DATA_URL.'/editor/'.$ym;
mkdir($data_dir, G5_DIR_PERMISSION);
chmod($data_dir, G5_DIR_PERMISSION);
$tmp_name = $_FILES['SummernoteFile']['tmp_name'];
$name = $_FILES['SummernoteFile']['name'];
$filename_ext = strtolower(array_pop(explode('.',$name)));
$mime_result = ' '.mime_content_type($tmp_name);
// thanks to @dewoweb
if (!preg_match("/(jpeg|jpg|gif|bmp|png)$/i", $filename_ext)) { // check file extension
// error
unlink($tmp_name);
echo json_encode(array('success' => false, 'error' => 100)); // file type error
} else if ( !stripos($mime_result, 'jpeg') && // check file mime-type
!stripos($mime_result, 'jpg') &&
!stripos($mime_result, 'gif') &&
!stripos($mime_result, 'bmp') &&
!stripos($mime_result, 'png') ) {
unlink($tmp_name);
echo json_encode(array('success'=> false, 'error' => 101));
} else if (!getimagesize($tmp_name)) { // check image resolution, if resolutions is null, return fail
unlink($tmp_name);
echo json_encode(array('success'=> false, 'error' => 102));
} else {
$file_name = 'image'.get_microtime().".".$filename_ext;
$save_dir = sprintf('%s/%s', $data_dir, $file_name);
$save_url = sprintf('%s/%s', $data_url, $file_name);
move_uploaded_file($tmp_name, $save_dir);
echo json_encode(array('success' => true, 'save_url' => $save_url ));
}
} else {
$error = $_FILES['SummernoteFile']['error'];
// refer to error code : http://www.php.net/manual/en/features.file-upload.errors.php
// example) 1 is error for upload_max_filesize
echo json_encode(array('success'=> false, 'error' => $error));
}
?>
include "./_common.php";
$isUpload = is_uploaded_file($_FILES['SummernoteFile']['tmp_name']);
// SUCCESSFUL
if($isUpload) {
$ym = date('ym', G5_SERVER_TIME);
$data_dir = G5_DATA_PATH.'/editor/'.$ym;
$data_url = G5_DATA_URL.'/editor/'.$ym;
mkdir($data_dir, G5_DIR_PERMISSION);
chmod($data_dir, G5_DIR_PERMISSION);
$tmp_name = $_FILES['SummernoteFile']['tmp_name'];
$name = $_FILES['SummernoteFile']['name'];
$filename_ext = strtolower(array_pop(explode('.',$name)));
$mime_result = ' '.mime_content_type($tmp_name);
// thanks to @dewoweb
if (!preg_match("/(jpeg|jpg|gif|bmp|png)$/i", $filename_ext)) { // check file extension
// error
unlink($tmp_name);
echo json_encode(array('success' => false, 'error' => 100)); // file type error
} else if ( !stripos($mime_result, 'jpeg') && // check file mime-type
!stripos($mime_result, 'jpg') &&
!stripos($mime_result, 'gif') &&
!stripos($mime_result, 'bmp') &&
!stripos($mime_result, 'png') ) {
unlink($tmp_name);
echo json_encode(array('success'=> false, 'error' => 101));
} else if (!getimagesize($tmp_name)) { // check image resolution, if resolutions is null, return fail
unlink($tmp_name);
echo json_encode(array('success'=> false, 'error' => 102));
} else {
$file_name = 'image'.get_microtime().".".$filename_ext;
$save_dir = sprintf('%s/%s', $data_dir, $file_name);
$save_url = sprintf('%s/%s', $data_url, $file_name);
move_uploaded_file($tmp_name, $save_dir);
echo json_encode(array('success' => true, 'save_url' => $save_url ));
}
} else {
$error = $_FILES['SummernoteFile']['error'];
// refer to error code : http://www.php.net/manual/en/features.file-upload.errors.php
// example) 1 is error for upload_max_filesize
echo json_encode(array('success'=> false, 'error' => $error));
}
?>
그누보드 이미지 업로드 체크 부분인데
취약한 부분이 있는지요..
댓글 4
글쓰신분의 코드를 분석해보니 index.jpg.php로 업로드하면 그대로 실행될듯 보이네요.
19번, 20번째줄과 더불어 그 아래쪽 코드들이 많이 취약해보입니다.
http://php.net/manual/en/function.pathinfo.php
파일체크에 정규식을 강화할 의향이 없으시다면 pathinfo를 사용하시는게 더 도움되실겁니다.
그아래쪽 코드라면 전부 말씀하시는건데 어캐우회하실건지..?
이번에 그누보드5.3.에 섬머노트 작업해서 올렸는데 딱히 문제될건 없을듯 합니다.
그래도 해커들이 뚫겠다고하면 어쩔수 없지 않나요....ㅠㅠ