PHP file upload processing logic review (comprehensive analysis)

This article will introduce to you the logic implementation analysis of PHP file upload. This kind of implementation must be relatively common in projects. Let's take a look~ I hope it will be helpful to friends in need~

File name processing

The file name depends on the business requirements. If there is no need to retain the original name, just randomly generate the name and add the suffix verified by the whitelist. [Recommended learning: PHP video tutorial]

On the contrary, handle it with caution:

//允许上传的后缀白名单
$extension_white_list = ['jpg', 'pdf'];
//原始文件的名字
$origin_file_name = 'xx/xxx/10月CPI同比上涨2.1%.php.pdf';
//提取文件后缀，并校验是否在白名单内
$extension = strtolower(pathinfo($origin_file_name, PATHINFO_EXTENSION));
if (!in_array($extension, $extension_white_list)) {
    die('错误的文件类型');
}
//提取文件名
$new_file_name = pathinfo($origin_file_name, PATHINFO_BASENAME);
//截取掉后缀部分
$new_file_name = mb_substr($new_file_name, 0, mb_strlen($new_file_name) - 1 - mb_strlen($extension));
//只保留有限长度的名字
$new_file_name = mb_substr($new_file_name, 0, 20);
//替换掉所有的 . 避免攻击者构造多后缀的文件，缺点是文件名不能包含 .
$new_file_name = str_replace('.', '_', $new_file_name);
//把处理过的名字和后缀拼接起来构造成一个名字
$new_file_name = $new_file_name . '.' . $extension;
print_r($new_file_name); //10月CPI同比上涨2_1%_php.pdf

File content processing

The file suffix is ​​just On the surface, changing the suffix of a PHP file to jpg cannot change the fact that it carries PHP code.

For image files, you can read the image file header to determine the image type. Of course, I have not tested this method. If you are interested, you can test it yourself.

In addition, even if the above method is feasible, it can still be bypassed. Just write the bytes of the header characteristics of a certain image type in the header of the php file to disguise it.

For image file content processing, the real trick is to redraw the image.

Use the copy command under the windows system to create an image file containing php code. The command is as follows:

Copy 1.jpg/b + test.php/a 2.jpg

The above command means to merge test.php to the end of 1.jpg. And re-export it to 2.jpg. In this way, this 2.jpg is an image file containing PHP code. You can open it with Notepad and drag the scroll bar to the bottom to see the PHP code.

For unclean pictures like this, you can remove the unclean parts by redrawing the picture. The following is the php code to redraw the image:

try {
    $jpg = '包含php代码的.jpg';
    list($width, $height) = getimagesize($jpg);
    $im = imagecreatetruecolor($width, $height);
    $image = imagecreatefromjpeg($jpg);
    imagecopyresampled($im, $image, 0, 0, 0, 0, $width, $height, $width, $height);
    $target = '重绘后干净的图片.jpg';
    imagejpeg($image, $target);
} finally {
    isset($im) && is_resource($im) && imagedestroy($im);
    isset($image) && is_resource($image) && imagedestroy($image);
}

The disadvantages of this method are that it consumes memory, the image is distorted, and it can only process images.

Of course, I don’t know if other file formats can be processed using the redrawing method.

File permission processing

Only discuss the permissions under Linux, first briefly introduce the permissions under Linux:

读取，字母 r 或数字 4 表示
写入，字母 w 或数字 2 表示
执行，字母 x 或数字 1 表示

For files, rwx is as follows Meaning:

r：可打开读取此文件
w：可写入此文件
x：可执行此文件

For directories, the meaning of rwx is a little different:

r：可读取此目录的内容列表
w：可在此目录里面进行：增、删、改文件和子目录
x：可进入此目录

In addition, in Linux, users will be divided into three types for a file, namely: Create the file A user who is in the same group as the user who created the file, who is neither the creator nor another user in the same group.

With the understanding of Linux permissions, 755 permissions should be set for the directory where the uploaded file is located, which means:

• The user who created the directory has read access , write and enter permissions to this directory

• Users in the same user group as the user who created the directory have permissions to read and enter this directory

• Neither the creator nor other users in the same group have permission to read and enter this directory.

755 permission setting allows nginx to proxy static files. No 403 error will be reported.

Code example:

mkdir($save_path, 0755, true);

For uploaded files, use more stringent permission settings. 644 permissions should be set, which means:

• Create The user of this file has the permission to read and write this file and cannot execute it

• Users in the same user group as the user who created the file only have read permission

• Other users who are neither the creator nor the same group only have read permission

644 permission settings, which ensures that even if an illegal file is uploaded It is also impossible to change the content and execute it.

Code example:

chmod($file, 0644);

File server processing

Purchase money to buy an oss storage service, don’t even think about it, just throw it in .

Original address: https://learnku.com/articles/73100
Author’s blog: https://learnku.com/blog/buexplain

The above is the detailed content of PHP file upload processing logic review (comprehensive analysis). For more information, please follow other related articles on the PHP Chinese website!