Re: Multipart Form - Ascertain File Type
This WebDNA talk-list message is from 2007
It keeps the original formatting.
numero = 68741
interpreted = N
texte = Ok, you guys have definitely given me something to think about. Knowing that I don't necessarily have the ability to determine the difference between a text file and a potential virus changes my plans a bit. I've been using this process for our intranet, which wasn't an issue. But we're considering opening this capability up to some clients. Not sure it's really that safe now. Gary, if you happen to locate the template you mentioned, could you please email it to me at tana@volleyhut.com? I'd really appreciate it. I can still use that capability for our intranet. Thanks so much for all your responses. They were very helpful. Tana ---------------------------------- Gary Krockover wrote: If you have the default install of WebDNA on your server, take a look at the file /admin/upload_multiphotos2.tpl It shows you how to distinguish between a .jpg and a .gif file. I've used that basic file to figure out the file extensions. However be aware that just because the file says it's a .txt does not actually mean it IS a txt. For image validation I sometimes run the .gif or .jpg through ImageMagic. If a real image is created then it was an image file. But if this is an open form for all web visitor you will have to test the validity somehow. If this is for your customers, well, you *should* be able to trust them, right? -- Matthew A Perosi Psi Prime, Inc. http://www.psiprime.com 323 Union Blvd. Totowa, NJ 07512 P: 973.225.9870 F: 973.413.8217 ---------------------------------- Gary Krockover wrote: Was it Dan Strong's template....not sure, but there's a template floating around that let's you set some variables; one of them being the file extension that it will accept for an upload. I'll see if I can find a copy of that somewhere. If you need to verify the type of file after it's been uploaded and then do something with it if it isn't what it says it is, then you'll need some other mojo for that of course. GJK ---------------------------------- John Peacock wrote: AFAICT, this is impossible to do on the front end. In other words, the multipart MIME upload doesn't have any mechanism to validate the file contents when uploaded. That doesn't mean you can't validate the file after the fact, and simply delete anything that doesn't meet whatever criteria you like (too large, not a JPEG, not named .txt, etc). Be aware that trying to determine what the file contains using only the filename (especially extension) is fraught with danger and pitfalls. One of the results of M$loth's infinite stupidity is the constant issue with e-mail attachments of the form innocuous_file.txt.exe, which based on default (read: STUPID) Windows default is displayed as innocuous_file.txt when in actuality, it is a worm/virus/rootkit... John -- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748 -----Original Message----- From: Tana Adams [mailto:tana@volleyhut.com] Sent: Friday, March 30, 2007 11:09 AM To: WebDNA Talk Subject: Multipart Form - Ascertain File Type Hi, I was wondering if anyone knew how to ascertain what type of file was being uploaded when using a multipart form. I'm trying to create a file upload that will only allow a .txt file to be uploaded. I've tried to ascertain the file type coming in using the formvariables context but it doesn't seem to work. The form works fine...files uploading without problem. Does anyone have any ideas? Thank you, Tana ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list
. To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Associated Messages, from the most recent to the oldest:
Ok, you guys have definitely given me something to think about. Knowing that I don't necessarily have the ability to determine the difference between a text file and a potential virus changes my plans a bit. I've been using this process for our intranet, which wasn't an issue. But we're considering opening this capability up to some clients. Not sure it's really that safe now. Gary, if you happen to locate the template you mentioned, could you please email it to me at tana@volleyhut.com? I'd really appreciate it. I can still use that capability for our intranet. Thanks so much for all your responses. They were very helpful. Tana ---------------------------------- Gary Krockover wrote: If you have the default install of WebDNA on your server, take a look at the file /admin/upload_multiphotos2.tpl It shows you how to distinguish between a .jpg and a .gif file. I've used that basic file to figure out the file extensions. However be aware that just because the file says it's a .txt does not actually mean it IS a txt. For image validation I sometimes run the .gif or .jpg through ImageMagic. If a real image is created then it was an image file. But if this is an open form for all web visitor you will have to test the validity somehow. If this is for your customers, well, you *should* be able to trust them, right? -- Matthew A Perosi Psi Prime, Inc. http://www.psiprime.com 323 Union Blvd. Totowa, NJ 07512 P: 973.225.9870 F: 973.413.8217 ---------------------------------- Gary Krockover wrote: Was it Dan Strong's template....not sure, but there's a template floating around that let's you set some variables; one of them being the file extension that it will accept for an upload. I'll see if I can find a copy of that somewhere. If you need to verify the type of file after it's been uploaded and then do something with it if it isn't what it says it is, then you'll need some other mojo for that of course. GJK ---------------------------------- John Peacock wrote: AFAICT, this is impossible to do on the front end. In other words, the multipart MIME upload doesn't have any mechanism to validate the file contents when uploaded. That doesn't mean you can't validate the file after the fact, and simply delete anything that doesn't meet whatever criteria you like (too large, not a JPEG, not named .txt, etc). Be aware that trying to determine what the file contains using only the filename (especially extension) is fraught with danger and pitfalls. One of the results of M$loth's infinite stupidity is the constant issue with e-mail attachments of the form innocuous_file.txt.exe, which based on default (read: STUPID) Windows default is displayed as innocuous_file.txt when in actuality, it is a worm/virus/rootkit... John -- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748 -----Original Message----- From: Tana Adams [mailto:tana@volleyhut.com] Sent: Friday, March 30, 2007 11:09 AM To: WebDNA Talk Subject: Multipart Form - Ascertain File Type Hi, I was wondering if anyone knew how to ascertain what type of file was being uploaded when using a multipart form. I'm trying to create a file upload that will only allow a .txt file to be uploaded. I've tried to ascertain the file type coming in using the formvariables context but it doesn't seem to work. The form works fine...files uploading without problem. Does anyone have any ideas? Thank you, Tana ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
"Tana Adams"
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Changes to the List (1997)
Passing WebCat Vars with Javascript (2000)
Sendmail and attachments? (1998)
WebCommerce: Folder organization ? (1997)
AOL Sux and Other Thoughts (2000)
[WebDNA] v7 with SSL (2012)
Here's how to kill a Butler Database. (1997)
wierd [cart] action! (1997)
Emailer setup (1997)
mysql errors (2005)
Re:2nd WebCatalog2 Feature Request (1996)
WebCat2b13MacPlugIn - syntax to convert date (1997)
[date] formatting bug inside [orderfile]? (1998)
Trigger: Only on Saturday (2001)
PIXO (1997)
[WebDNA] Dreamweaver Tag Libraries and Snippets (2010)
Separate SSL Server (1997)
WC2b15 - [HTMLx]...[/HTMLx] problems (1997)
Multiple cart additions (1997)
WebMerchant 1.6 and SHTML (1997)