Edit Question - KnowledgeHub

Title Body

I develop a php script to replace a current one, that will have a lot of exposure to various markets/countries. This script between others offers an photo upload functionality . After a lot of reading about the issue, I followed the approach described below. I would deeply appreciate your comments on its security. The photo is uploaded in a private 777 folder outside web root. A check for white listed extensions is performed (allow only jpgs, gifs, pngs) everything else is deleted. Use of getimagesize to check of min-max dimensions and photo validity. Check of mimetype and file extension match. Resizing of uploaded photo to std dimensions (using imagecopyresampled). Saving the created files as jpg. Removal of original file. Save photos with a new (not random name) ie img51244.jpg. Move the new photos to variable subdirectories of a public folder (777 permissions) according to a non predictable algorithm. I.e., img10000.jpg will be stored at photos/a/f/0/img10000.jpg while img10001.jpg will be stored at photos/0/9/3/img10001.jpg . This is done for other reasons (use of subdomains for static content serve or use of a CDN). The script will run on a linux dedicated server.

Tags (comma-separated) Cancel