Is this script secure if protected by .htaccess?

[webref.eu]

Hi All

 

Someone earlier kindly gave me a simple file upload script, which is fine for what I need.  I will be using this script in an Admin area of my site, which is within a folder protected by .htaccess. 

 

I post the script below for your reference, and would like to know if this is ok security wise considering it will be located in a .htaccess protected directory? 

 

Thanks for any comments. 

 

Rgds

 

<?php
//retrieve the value of ProductId
$ProductId = $_GET['ProductId'];


//Protection from hackers.  Check ProductId is just a number
$TestForNumber = is_numeric($ProductId);
If ($TestForNumber == 0) {
echo "Sorry, the Product Id tried is not allowed.";
exit();
}




if(isset($_POST['submit'])) {

   $dir = "../images/products/"; // this directory needs to exist and permissions need to be 0777
   
   $imagename = basename($_FILES['image']['name']);
   
   $newimage = $dir.$imagename;
   
   move_uploaded_file($_FILES['image']['tmp_name'], $newimage);
   
   echo "Image uploaded.  <a href='control-panel.php'>Return to Control Panel</a>.";
   
   exit();

}

?>

<form method="POST" enctype="multipart/form-data"  action="">
   
   
   <p>Please upload a file called <?=$ProductId?>.jpg:</p>
   <input type="file" name="image" /><br /><br />
   
   <input type="submit" name="submit" value="Upload Image" />
   
</form>

[TomNomNom]

Anything protected by a .htaccess file will be as secure as your .htaccess file.

 

However, you should always plan for the worst. If your .htaccess authentication gets brute forced (or someone gains access to your username and password by other means), you could find yourself in real trouble.

 

If the directory that the files are uploaded to is accessible via http, an attacker could upload whatever they wanted (I.E. malicious code) and then execute it with ease.

 

You should at the very least check the file extension of the file being uploaded, and probably check its MIME type (try the Fileinfo Pecl extension, or mime_content_type() if you have to) to make sure it's an image.

 

It's also good idea to make sure that any files a user (be it you or anyone else) uploads are not accessible via http, if at all possible.

 

Good luck to you, good sir :-)

[xcoderx]

I told him that before add some blacklists to restrict some extns the most common file used is a .php.jpg extn il not mention what that is but since it has .jpg at the end the file is easily uploaded n then boom.

[webref.eu]

Thanks for the comments so far.

 

Rgds