Re: Chatting portal with pictures.

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Chatting portal with pictures.
Date	2020-06-24 23:34 +0200
Message-ID	<hlhv7hF67icU1@mid.individual.net> (permalink)
References	<cdde608a-8a67-484c-b7c7-123db2105555o@googlegroups.com>

Show all headers | View raw

On 24/06/2020 19.41, kristjan1291983@gmail.com wrote:
> Files:

Please register a free account at github.com and store your projects 
there, all you need to do is give the link to the repository in question 
and then people will always manage to see the latest version of your 
project instead of having to go through a million posts.

> 1index.php
> 
> <!DOCTYPE html>
> <html>
> <body>
> 
> <form action="1upload.php" method="post" enctype="multipart/form-data">
>      File to upload:
>      <p></p>
>      <input type="file" name="fileToUpload" id="fileToUpload"/>
>      <p></p>
>      <input type="submit" value="Upload file" name="submit" />
> 
> </form>
> 
> <p></p>
> <p></p>
> 
> <p>Files in /files :</p>
> <?php
> 
> $dirs = array_filter(glob('*'), 'is_dir');
> $fexists=false;
> foreach ($dirs as $k=>$v) {
>     if($v=="files") $fexists=true;
> }

don't keep on looping when you have found what you were looking for, 
break as soon as you have found the directory, but you should ensure 
it's a directory and not a file/symlink/socket/...

I do think you can do this faster just by checking if the directory 
exists in first place, you know it's in the same directory and it's 
called files.

> if(count($files1)>1000) {
>      rrmdir("files");
>      mkdir("files", 0755);
> }

So anyone can delete all the files, just spam your upload script 1000 
times. Most filesystems do handle far more files than just 1000, sure 
your system has performance issues.

> if(empty($_REQUEST['method'])||empty($_REQUEST['passphrase'])) {
>     exit(0);
> }
> 
> $passphrase=$_REQUEST['passphrase'];
> 
> if(strlen($passphrase)<1) exit(0);

You already checked that it was empty, so why do it again here?
By the way, exit(0) is an ugly way to stop, you should always provide 
information of some kind to the user, for example missing pass phrase.

> $target_dir = "files2/";
> $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
> $uploadOk = 1;
> 
> if (file_exists($target_file)) {
>      echo "File already exists.";
>      $uploadOk = 0;
> }
> if ($_FILES["fileToUpload"]["size"] > 500000) {
>      echo "Your file is too large.";
>      $uploadOk = 0;
> }
> if ($uploadOk == 0) {
> } else {
>      if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
> 
>      } else {
>          echo "There was an error uploading your file.";
>      }
> }
> 
> 
> $inputt = file_get_contents($target_file, true);
> 
> 
> if($_REQUEST['method']=='crypt') {

There is support for encryption/decryption in php, see 
openssl_encrypt/openssl_decrypt. To make the encryption better, add a salt.

>          $url  = isset($_SERVER['HTTPS']) ? 'https://' : 'http://';

you should prevent the code working on insecure connections, otherwise 
anyone can get hold of the pass phrase by sniffing the traffic.

...

-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Chatting portal with pictures. kristjan1291983@gmail.com - 2020-06-24 10:41 -0700
  Re: Chatting portal with pictures. "J.O. Aho" <user@example.net> - 2020-06-24 23:34 +0200

csiph-web