close ad
Databridge V2 with MySQLi support IS Now Available!
open ad
View Menu

Technical Support Forums

Free, outstanding support from WebAssist and your colleagues

rating

File extension won't validate on upload.

Thread began 8/09/2018 1:26 pm by BillHobbs | Last modified 8/10/2018 2:50 pm by Ray Borduin | 137 views | 8 replies |

BillHobbs

File extension won't validate on upload.

I've been trying to validate the extension on a file to be uploaded and it doesn't seem to work. I've tried several variations to no avail.

The file will upload if the validation is set to include a blank value.

The upload script:
<?php
// WA_UploadResult1 Params Start
$WA_UploadResult1_Params = array();
// WA_UploadResult1_1 Start
$WA_UploadResult1_Params["WA_UploadResult1_1"] = array(
'UploadFolder' => "vendorlogos/",
'FileName' => "[FileName]",
'DefaultFileName' => "NoImage.png",
'ResizeType' => "1",
'ResizeWidth' => "350",
'ResizeHeight' => "350",
'ResizeFillColor' => "#FFFFFF" );
// WA_UploadResult1_1 End
// WA_UploadResult1 Params End
?>
<?php
WA_DFP_SetupUploadStatusStruct("WA_UploadResult1");
if(isset($_POST["SubmitButton"]) || isset($_POST["SubmitButton_x"])){
WA_DFP_UploadFiles("WA_UploadResult1", "vendorLogo", "0", "", "false", $WA_UploadResult1_Params);
}
?>

The validation script:
<?php
if (isset($_POST["SubmitButton"]) || isset($_POST["SubmitButton_x"])) {
$WAFV_Redirect = "error.html";
$_SESSION['WAVT_vendorhome_467_Errors'] = "";
if ($WAFV_Redirect == "") {
$WAFV_Redirect = $_SERVER["PHP_SELF"];
}
$WAFV_Errors = "";
$WAFV_Errors .= WAValidateFE(($WA_DFP_UploadStatus["WA_UploadResult1"]["fileExtension"]) . "",".gif, .jpg, .jpeg, .png",true,2);

if ($WAFV_Errors != "") {
PostResult($WAFV_Redirect,$WAFV_Errors,"vendorhome_467");
}
}
?>

Sign in to reply to this post

Ray BorduinWebAssist

Is the validation code above the file upload code? UploadResult values can't be validated before the file upload has processed. Try validating with the form element value from the form directly instead of the file extension from the processed upload.

Sign in to reply to this post

BillHobbs

Thank you for your quick response.

The validation scripts are before the upload scripts. I chose Validation as File Extension. The variable is vendorLogo Extension. When choosing the variable the value is: <?php echo (((isset($_FILES["vendorLogo"]))? preg_replace('/^.*\./', '', $_FILES["vendorLogo"]["name"]) :"")); ?>
It still doesn't work.

I've attached two pics of the screens with the choices I made.

Sign in to reply to this post

Ray BorduinWebAssist

That looks like it would work. Can I get a copy of the page? I'll put it on my localhost and do some testing.

Sign in to reply to this post

BillHobbs

Here it is. I added a gutted version that had just the upload and validate code.

Attached Files
vendor-gutted.php
vendor-home.php
Sign in to reply to this post

Ray BorduinWebAssist

It is a little confusing, but you need to validate the first value (the full file name) not just the extension... so the code should be:

$WAFV_Errors .= WAValidateFE(((isset($_FILES["vendorLogo"]))?$_FILES["vendorLogo"]["name"]:"") . "",".gif, .jpg, .jpeg, .png",true,2);


When you choose just the extension, then it removes the "." in front, and that won't validate properly. The File Extension validation will automatically strip the file name and validate just the extension part.

Sign in to reply to this post

BillHobbs

Thank you.

That seemed to work. I do have one other question about security. Can someone upload an executable file like hackme.jpg.php? Is this pretty secure or do I need to add something to increase the security.

Thanks again.

Sign in to reply to this post

Ray BorduinWebAssist

It only would allow .jpg and not .jpg.php files.

Sign in to reply to this post

BillHobbs

Thanks.

Sign in to reply to this post

Build websites with a little help from your friends

Your friends over here at WebAssist! These Dreamweaver extensions will assist you in building unlimited, custom websites.

Build websites from already-built web applications

These out-of-the-box solutions provide you proven, tested applications that can be up and running now.  Build a store, a gallery, or a web-based email solution.

Want your website pre-built and hosted?

Close Windowclose

Rate your experience or provide feedback on this page

Account or customer service questions?
Please user our contact form.

Need technical support?
Please visit support to ask a question

Content

rating

Layout

rating

Ease of use

rating

security code refresh image

We do not respond to comments submitted from this page directly, but we do read and analyze any feedback and will use it to help make your experience better in the future.

Close Windowclose

We were unable to retrieve the attached file

Close Windowclose

Attach and remove files

add attachmentAdd attachment
Close Windowclose

Enter the URL you would like to link to in your post

Close Windowclose

This is how you use right click RTF editing

Enable right click RTF editing option allows you to add html markup into your tutorial such as images, bulleted lists, files and more...

-- click to close --

Uploading file...