Upload script

[Tom10]

if($_SERVER['REQUEST_METHOD'] == "POST")
{
	$dir = "./";
	$file = $dir . basename($_FILES['userfile']['name']);
	$ext = pathinfo($file, PATHINFO_EXTENSION);
	$filename = $_FILES['userfile']['name'];

	$allowed = array('jpg', 'png', 'gif', 'bmp');

	if($_FILES['userfile']['size'] > 10000)
	{
		die("File is too large!");
	}
	if($ext != $allowed)
	{
		die("Invalid Image File. Possible hack attempt!");
	}
	if(move_uploaded_file($_FILES['userfile']['tmp_name'], $dir))
	{
		echo "File: ".$_FILES['userfile']['name']." has been uploaded to ".$dir."! ";
	} else
	{
		die("Error: ".$_FILES['userfile']['error']." ");
	}
}

i get no errors but 

if($ext != $allowed)
	{
		die("Invalid Image File. Possible hack attempt!");
	}

is the problem, it just says Invalid Image File. Possible hack attempt!

 

[QuickOldCar]

this

if($ext != $allowed)
{
  die("Invalid Image File. Possible hack attempt!");
}

to

if(!in_array($ext,$allowed))
{
  die("Invalid Image File. Possible hack attempt!");
}

[Tom10]

Now it say's Error: 2 

else
	{
		die("Error: ".$_FILES['userfile']['error']." ");
	}

i'm guessing it's that?

[QuickOldCar]

Could be file permissions

Maybe make a directory named upload and give it 755 permission for www-data

 

$dir = "./upload/";

[QuickOldCar]

Actually move_uploaded_file is looking for the full path, added that into code and using directory named upload

if($_SERVER['REQUEST_METHOD'] == "POST")
{
	$dir = "./upload/";
	$file = $dir . basename($_FILES['userfile']['name']);
	$ext = pathinfo($file, PATHINFO_EXTENSION);
	$filename = $_FILES['userfile']['name'];
	$path = $dir . $filename;

	$allowed = array('jpg', 'png', 'gif', 'bmp');

	if($_FILES['userfile']['size'] > 10000)
	{
		die("File is too large!");
	}
	if(!in_array($ext,$allowed))
{
  die("Invalid Image File. Possible hack attempt!");
}
	if(move_uploaded_file($_FILES['userfile']['tmp_name'], $path))
	{
		echo "File: ".$_FILES['userfile']['name']." has been uploaded to ".$path."! ";
	} else
	{
		die("Error: ".$_FILES['userfile']['error']." ");
	}
}

[Tom10]

Thank you