gitea-admin
/
DevWEB
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update upload.php

This commit is contained in:
gitea-admin 2026-01-08 22:57:58 +00:00
parent 1f333fb935
commit 53b496a74e
1 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
upload.php
View File

@ -17,15 +17,22 @@ $imageName = null;
if (!empty($_FILES['image']['name'])) { if (!empty($_FILES['image']['name'])) {
/* #if ($_FILES['image']['error'] !== UPLOAD_ERR_OK) {*/ // Vérifier si l'upload s'est bien passé
/* # die("Error de sauvegarde d'image");*/ if ($_FILES['image']['error'] !== UPLOAD_ERR_OK) {
/* #}*/ die("Erreur lors de l'upload de l'image");
}
/* #if ($_FILES['image']['size'] < 2 * 1024 * 1024) {*/ // Vérifier que le fichier temporaire existe
/* # die("Erreur, Image trop petite.");*/ if (!is_uploaded_file($_FILES['image']['tmp_name'])) {
/* #}*/ die("Fichier non valide ou non téléchargé");
}
/* Verify MIME type using finfo */ // Vérifier la taille (max 2 Mo ici)
if ($_FILES['image']['size'] > 2 * 1024 * 1024) {
die("Image trop grosse (max 2 Mo)");
}
// Vérifier le type MIME réel
$finfo = new finfo(FILEINFO_MIME_TYPE); $finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($_FILES['image']['tmp_name']); $mime = $finfo->file($_FILES['image']['tmp_name']);
@ -35,16 +42,16 @@ if (!empty($_FILES['image']['name'])) {
]; ];
if (!array_key_exists($mime, $allowedMimes)) { if (!array_key_exists($mime, $allowedMimes)) {
die("Type d'image invalid"); die("Type d'image invalide");
} }
/* Verify image structure */ // Vérifier que c'est bien une image
$imageInfo = getimagesize($_FILES['image']['tmp_name']); $imageInfo = getimagesize($_FILES['image']['tmp_name']);
if ($imageInfo === false) { if ($imageInfo === false) {
die("Le fichier n'est pas une image valide"); die("Le fichier n'est pas une image valide");
} }
/* Re-encode image to destroy polyglots */ // Re-encoder l'image pour éviter les polyglots
$ext = $allowedMimes[$mime]; $ext = $allowedMimes[$mime];
$imageName = bin2hex(random_bytes(16)) . '.' . $ext; $imageName = bin2hex(random_bytes(16)) . '.' . $ext;
$uploadPath = __DIR__ . "/uploads/" . $imageName; $uploadPath = __DIR__ . "/uploads/" . $imageName;
@ -60,6 +67,7 @@ if (!empty($_FILES['image']['name'])) {
imagedestroy($img); imagedestroy($img);
} }
/* Store comment */ /* Store comment */
$stmt = $pdo->prepare("INSERT INTO posts (message, image, ip) VALUES (?, ?, ?)"); $stmt = $pdo->prepare("INSERT INTO posts (message, image, ip) VALUES (?, ?, ?)");
$stmt->execute([ $stmt->execute([