| Re: Do not rename image uploaded with Xoops Image manager ? |
| by Catzwolf on 2009/3/4 3:03:39 The problem with the current uploader class is that it isn't that very bright. It actually doesn't do proper check to see if the file that is being uploaded is actually the mimetype it should be. All it does it check the file extension and then to see if that extension matches the mimetype using not very reliable methods. All the script really does, is not allow files with certain extensions like php etc. The current system can be easily fooled and I have done it in tests over this last week. The uploader should check the validity of a file using file headers using the php 'finfo_open' and mime magic before it tries any other method of mimetype detection. But you are correct, never edit the class directly always the main area that calls the class. Catz |
| Re: Do not rename image uploaded with Xoops Image manager ? |
| by bitter_end on 2009/2/17 14:13:02 Thanks a lot. This small code saved my life. I was working on another issue and forun the solution here. My need was the opposite and I added this code and worked well for me. |
| Re: Do not rename image uploaded with Xoops Image manager ? |
| by Burning on 2009/1/22 13:29:36 hi, Thanks a lot  !
|
| Re: Do not rename image uploaded with Xoops Image manager ? |
| by icomuser on 2009/1/21 0:48:23 sorry someone, i know this question has been unanswered for a few days, and it really is a simple request which a core team developer could easily have answered. but your method is not secure and not the best method. please don't take this the wrong way. by altering uploader class like this, you are not just affecting the image uploader, but you are affecting any other module and core function that uses the uploader class. random file names are there for a security reason because if your script allows executable files etc, and the path becomes known and the file is not stored outside of webroot, the filename would be known because a user has uploaded it. he can then gain complete access to the server by uploading a malicious script and then calling it from his browser. if you want the image manager to not use a random prefix, then edit the image manager file directly not the uploader class. in htdocs/imagemanager.php around line 217: remove this line > le="color: #000000"><?php $uploader->setPrefix('img'); now that will let the uploader class not set random prefix for image files, but will still allow other modules to have random prefixes should they want to use the setPrefix() function. regards vaughan |
| Do not rename image uploaded with Xoops Image manager ? |
| by Burning on 2009/1/16 9:10:32 hi, I'm using XOOPS Image manager but - if it's possible - I would like to keep original image name. At this time : 20091016_myimage.jpg ---> What I would have : 20091016_myimage.jpg ---> 20091016_myimage.jpg I've looked for but not found information on this forums  Thanks in advance ! |
Search
Recent Posts
Who's Online
Donat-O-Meter
| Stats | |
| Goal: | $15.00 |
| Due Date: | Jul 31 |
| Gross Amount: | $0.00 |
| Net Balance: | $0.00 |
| Left to go: | $15.00 |
|
|