File uploading; "image/jpg", sure. But what about movies, etc?

[Michan]

Hi everyone,

 

I've created a file upload for images, and would like to duplicate one for other files that do not include images, with limitations (i.e., I don't want people uploading .exes, .ppts, etc).

 

Is there a list of all of the file types and extensions?

 

Y'know, like "image/jpg", "image/png", etc?

 

The reason I'm asking is because I'm not sure what I should type before "/ext" ("movie/wmv"?), Word document ("word/doc"?), or other files.

 

A list would be appreciated. Thanks in advance!

[papaface]

http://www.webmaster-toolkit.com/mime-types.shtml

[Michan]

You are awesome.

 

Thank you very much!

[Michan]

Hmm, it doesn't seem to list the correct mime type for .wmv

 

Does anybody know this off hand?

[hvle]

video/wmv ?

[Michan]

video/wmv ?

 

This doesn't seem to work

[hvle]

prob this

audio/x-ms-wmv

http://support.microsoft.com/kb/288102

[corbin]

This is kind of random, but I suggest not trusting mime types supplied by the client as they're fakable.... Best bet is to just check the file extension.

[hvle]

This is kind of random, but I suggest not trusting mime types supplied by the client as they're fakable.... Best bet is to just check the file extension.

 

file extension not fakable?

 

mime type help server encode the file and client to handle the file appropriately, not extension.

 

[corbin]

The mime type is meaningless, and is often mapped to file extensions....

 

How do you fake a filename.ext?  Also, Windows handles files based on file extensions, so chances are, despite the mime type, there will be certain situations where Windows handles a .exe file with jpeg content as a .exe.  Also, if someone were to upload a .php file with a image/jpeg mimetype for example and then they accessed it some how or other, your server would run it.  (That would assume the PHP file was in the web root, or the file was being called via include() or require()).

 

I would just check the file extension of uploads, since my rule of thumb is to not trust anything sent by the client.  Of course the file extension could not match the contents, but that's often a less problematic situation than contents not matching the mime type....

[hvle]

The mime type is meaningless, and is often mapped to file extensions....

 

How do you fake a filename.ext?  Also, Windows handles files based on file extensions, so chances are, despite the mime type, there will be certain situations where Windows handles a .exe file with jpeg content as a .exe.  Also, if someone were to upload a .php file with a image/jpeg mimetype for example and then they accessed it some how or other, your server would run it.  (That would assume the PHP file was in the web root, or the file was being called via include() or require()).

 

I would just check the file extension of uploads, since my rule of thumb is to not trust anything sent by the client.  Of course the file extension could not match the contents, but that's often a less problematic situation than contents not matching the mime type....

 

How do I fake filename ext?  easy:  ren *.pdf *.txt

 

Windows is stupid, period.

Try to upload an .exe using mime type text/html

 

upload .PHP file?  There is no rule to tell you have to save the upload file the same name as it was in local machine.  And if you do that, you're too dumb to be programmer.