Sicherheit beim Upload

[Sven Rautenberg]

Moin!

siehe
http://forum.de.selfhtml.org/my/?t=206724&m=1403946&aaf=1
http://wiki.selfhtml.org/wiki/Artikel:PHP/File_Upload

  if ( move\_uploaded\_file ( $\_FILES['bild']['tmp\_name'], 'abgespeichertes\_bild.jpg' )  

move_uploaded_file() ist obsolet, wenn man $_FILES benutzt

Dann erklärst du uns jetzt am besten mal, warum PHP bei move_uploaded_file() intern diese Dinge tut, die sich allesamt so lesen, als würden dort explizit Checks durchgeführt, die einen erfolgten Dateiupload prüfen:

https://svn.php.net/viewvc/php/php-src/trunk/ext/standard/basic_functions.c?revision=314452&view=markup

  
5739	/* {{{ proto bool move_uploaded_file(string path, string new_path)  
5740	   Move a file if and only if it was created by an upload */  
5741	PHP_FUNCTION(move_uploaded_file)  
5742	{  
5743	    char *path, *new_path;  
5744	    int path_len, new_path_len;  
5745	    zend_bool successful = 0;  
5746	  
5747	#ifndef PHP_WIN32  
5748	    int oldmask; int ret;  
5749	#endif  
5750	  
5751	    if (!SG(rfc1867_uploaded_files)) {  
5752	        RETURN_FALSE;  
5753	    }  
5754	  
5755	    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &path, &path_len, &new_path, &new_path_len) == FAILURE) {  
5756	        return;  
5757	    }  
5758	  
5759	    if (!zend_hash_exists(SG(rfc1867_uploaded_files), path, path_len + 1)) {  
5760	        RETURN_FALSE;  
5761	    }  
5762	  
5763	    if (php_check_open_basedir(new_path TSRMLS_CC)) {  
5764	        RETURN_FALSE;  
5765	    }  
5766	  
5767	    VCWD_UNLINK(new_path);  
5768	    if (VCWD_RENAME(path, new_path) == 0) {  
5769	        successful = 1;  
5770	#ifndef PHP_WIN32  
5771	        oldmask = umask(077);  
5772	        umask(oldmask);  
5773	  
5774	        ret = VCWD_CHMOD(new_path, 0666 & ~oldmask);  
5775	  
5776	        if (ret == -1) {  
5777	            php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", strerror(errno));  
5778	        }  
5779	#endif  
5780	    } else if (php_copy_file_ex(path, new_path, STREAM_DISABLE_OPEN_BASEDIR TSRMLS_CC) == SUCCESS) {  
5781	        VCWD_UNLINK(path);  
5782	        successful = 1;  
5783	    }  
5784	  
5785	    if (successful) {  
5786	        zend_hash_del(SG(rfc1867_uploaded_files), path, path_len + 1);  
5787	    } else {  
5788	        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to move '%s' to '%s'", path, new_path);  
5789	    }  
5790	  
5791	    RETURN_BOOL(successful);  
5792	}  
5793	/* }}} */  

- Sven Rautenberg