Strip filename of special characters

[hdbrandon]

Hi guys, here's my problem. 

 

I have an html upload form that enables a user to upload a photo, which get emailed to a forwarder that i've setup to relay to x@facebook.com, which will get posted to my Facebook wall. 

 

However, the same photo will get posted in a gallery, therefore the file upload name includes the server path.  Changing this will break the gallery.

 

IE if a user uploads a file named myphoto.jpg

$path_temp is ../gallery/myphoto.jpg

 

I need to strip the "../gallery" before it gets attached and sent via.  Once forwarded, Facebook doesnt seem to accept photos with the "../" as part of the filename (security I'd imagine). 

 

html form
..accepts the photo
$path_temp = date("Y-m-d_H-i",time()) . "_" . $HTTP_POST_FILES['ufile']['name'][0];

....needs to be stripped for facebook to post via their e-mail to wall functionality.
$facebookSafe = str_replace("../gallery/", "_", $path_temp);

...mail function 
mail_attachment($facebookSafe, "facebook@domain.com", $my_mail, $my_name, $my_replyto, $my_subject);

 

The filename is being stripped of the "../," but it's not attaching the file to the email (it's just including the name as a string & no photo).

 

How can I strip the uploaded filename of the charcaters and send via e-mail?

 

 

[requinix]

You probably have to alter mail_attachment(). Make it use basename when specifying the file name. Should look something like

"Content-Disposition: attachment; filename=" . basename($filename)

That way you still give it the proper file path (because it needs that) but will strip everything but the name when attaching.

[hdbrandon]

Thanks requinix, but I'm not sure that's the problem.

 

//purely the file name

$path_temp = date("Y-m-d_H-i",time()) . "_" . $HTTP_POST_FILES['ufile']['name'][0];

 

//throw path before it for the photo gallery

$path1= "../gallery/". $path_temp;

 

Here is my mail function:

function mail_attachment($filename, $mailto, $from_mail, $from_name, $replyto, $subject) {
	    $file = $filename;
	    $file_size = filesize($file);
	    $handle = fopen($file, "r");
	    $content = fread($handle, $file_size);
	    fclose($handle);
	    $content = chunk_split(base64_encode($content));
	    $uid = md5(uniqid(time()));
	    $name = basename($file);
	    $header = "From: ".$from_name." <".$from_mail.">\r\n";
	    $header .= "Reply-To: ".$replyto."\r\n";
	    $header .= "MIME-Version: 1.0\r\n";
	    $header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n\r\n";
	    $header .= "This is a multi-part message in MIME format.\r\n";
	    $header .= "--".$uid."\r\n";
	    $header .= "Content-type:text/plain; charset=iso-8859-1\r\n";
	    $header .= "Content-Transfer-Encoding: 7bit\r\n\r\n";
	    //$header .= $message."\r\n\r\n";
	    $header .= "--".$uid."\r\n";
	    $header .= "Content-Type: application/octet-stream; name=\"".$filename."\"\r\n"; // use different content types here
	    $header .= "Content-Transfer-Encoding: base64\r\n";
	    $header .= "Content-Disposition: attachment; filename=\"".$filename."\"\r\n\r\n";
	    $header .= $content."\r\n\r\n";
	    $header .= "--".$uid."--";
	   	if (mail($mailto, $subject, $message, $header)) {
	        echo "<br/><br/>Mail Sent!"; // or use booleans here

	    } else {
	        echo "<br/><br/>Mail FAILD!";
	    }
	}

 

...calling the function.

mail_attachment($path_temp, "facebook@myDomain.com", $my_mail, $my_name, $my_replyto, $my_subject);

 

I'm getting the emails with 0K file attachements...it's just the name of the file, not the file itself.

[requinix]

Right. You're giving a filename but you aren't including the path. mail_attachment() can't find the file unless you give the right path to it.

So do that, and then use $name instead of $filename for the attachment name.

 

I see other potential issues. What's the whole script?

[hdbrandon]

Ok, so I've tried multiple ways.  Either the file gets attached properly but with a filename of ../gallery/X.jpg, which when forwarded to facebook will not get accepted, or the filename is correct but not file attached.

 

<?php
include("../framework/config.php");

//get IP address of uploader
$ipAddress = getenv("REMOTE_ADDR");

$path_temp = date("Y-m-d_H-i",time()) . "_" . $HTTP_POST_FILES['ufile']['name'][0];

$path1= "../gallery/". $path_temp;


//copy file to store
copy($HTTP_POST_FILES['ufile']['tmp_name'][0], $path1);


echo "File Name :".$HTTP_POST_FILES['ufile']['name'][0]."<BR/>";
echo "File Size :".$HTTP_POST_FILES['ufile']['size'][0]."<BR/>";
echo "File Type :".$HTTP_POST_FILES['ufile']['type'][0]."<BR/>";
echo "<img src=\"$path1\" width=\"150\" height=\"150\">";

//strip html and slashes, etc
$altOne=htmlspecialchars(stripcslashes($_POST[altOne]), ENT_QUOTES);
$descOne=htmlspecialchars(stripcslashes($_POST[descOne]), ENT_QUOTES);


$bwOne="$_POST[bwOne]";
$facebookOne="$_POST[facebookOne]";
$date = date("Y-m-d_H-i",time());
$store="$_POST[store]";

echo"Alt: $altOne <br> Desc: $descOne <br> Best/Worst: $bwOne <br>Facebook: $facebookOne<br><br><br>";


//display the error or success.

$filesize1=$HTTP_POST_FILES['ufile']['size'][0];


if($filesize1 != 0){

echo "We have recieved your files";

if($facebookOne == 'Y'){


	function mail_attachment($filename, $mailto, $from_mail, $from_name, $replyto, $subject) {

			    $file = $filename;
			    $file_size = filesize($file);
			    $handle = fopen($file, "r");
			    $content = fread($handle, $file_size);
			    fclose($handle);
			    $content = chunk_split(base64_encode($content));
			    $uid = md5(uniqid(time()));
			    $name = basename($file);
			    $header = "From: ".$from_name." <".$from_mail.">\r\n";
			    $header .= "Reply-To: ".$replyto."\r\n";
			    $header .= "MIME-Version: 1.0\r\n";
			    $header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n\r\n";
			    $header .= "This is a multi-part message in MIME format.\r\n";
			    $header .= "--".$uid."\r\n";
			    $header .= "Content-type:text/plain; charset=iso-8859-1\r\n";
			    $header .= "Content-Transfer-Encoding: 7bit\r\n\r\n";
			    $header .= "--".$uid."\r\n";
			    $header .= "Content-Type: application/octet-stream; name=\"".$filename."\"\r\n"; // use different content types here
			    $header .= "Content-Transfer-Encoding: base64\r\n";

			    $header .= "Content-Disposition: attachment; filename=\"".$filename."\"\r\n\r\n";

			    $header .= $content."\r\n\r\n";
			    $header .= "--".$uid."--";
			   	if (mail($mailto, $subject, $message, $header)) {
			        echo "<br/><br/>Mail Sent!"; // or use booleans here
			    } else {
			        echo "<br/><br/>Mail FAILD!";
			    }
			}

			$my_name = "My Name Here";
			$my_mail = "facebook@domain.com";
			$my_replyto = "facebook@domain.com";
			$my_subject = $_POST['descOne'];

			mail_attachment($path1_temp, "facebook@domain.com", $my_mail, $my_name, $my_replyto, $my_subject);


}
else{
}
}


else {
echo "ERROR.....";
}

// What files that have a problem? (if found)

if($filesize1==0) {
echo "There're something error in your first file";
echo "<BR />";
}

?>

 

Any ideas?

[requinix]

I'll say it again:

 

Use $filename when trying to read the file and such. Use $name instead of $filename for the "Content-Disposition: attachment; filename=" in the email.