<?php
error_reporting(0);
date_default_timezone_set('PRC');
if(isset($_FILES['file'])) {
$file_name = basename($_FILES["file"]["name"]);
$file_ext = pathinfo($file_name,PATHINFO_EXTENSION);
$file_type = $_FILES['file']['type'];
$file_content = $_FILES['file']['tmp_name'];
if(in_array($file_ext, ['php', 'php3', 'php4', 'php5', 'phtml', 'pht'])) {
die('Php file ?');
}
if (!in_array($file_type, ['image/jpeg', 'image/gif', 'image/png'])){
die('Bad file');
}
if (preg_match("/<\?php|eval|assert|@/i", file_get_contents($file_content))){
die('Bad file of content !');
}
if (!file_exists('uploads')){
mkdir('uploads');
}
$new_filename = md5(time()).'.'.$file_ext;
$u = move_uploaded_file($_FILES['file']['tmp_name'], './uploads/' . $new_filename);
if ($u){
echo 'Successful'."\n";
echo '/uploads/'.$new_filename;
}
}
?>
<html>
<body>
<meta charset="UTF-8">
<h2>File upload</h2>
<form action="" method="post" enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file"/><br />
<input type="submit" name="submit" value="submit" />
</form>
</body>
</html>
|
