PHP file upload script not functioning

Question

This is my php file uploading script. It does not work at all. Nothing happens. I have probably missed something.

<?php
if ((($_FILES["thumbfile"]["type"] == "image/gif")
|| ($_FILES["thumbfile"]["type"] == "image/jpeg")
|| ($_FILES["thumbfile"]["type"] == "image/pjpeg"))
&& ($_FILES["thumbfile"]["size"] < 20000))
  {
  if ($_FILES["thumbfile"]["error"] > 0)
    {
      move_uploaded_file($_FILES["thumbfile"]["tmp_name"],
     "http://www.divethegap.com/update/z-images/admin/upload/" . $_FILES["thumbfile"]["name"]);
      $filelocation = "http://www.divethegap.com/update/z-images/admin/upload/" . $_FILES["thumbfile"]["name"];

      echo '<script type="text/javascript">
parent.document.getElementById("thumbprogress").innerHTML = "Archiving"</script>Archiving';

    }
  }
else
  {
  echo '<script type="text/javascript">
parent.document.getElementById("thumbprogress").innerHTML = "Invalid File Format"</script>Invalid File Format';
  }
?>

Can anyone see problem?

Marvellous

Answer 1

move_uploaded_file() is not intended to to have a URL as a destination. You're in essence trying to take an uploaded file, and upload it yet again. What you want to use is a LOCAL file path, without a URL in it.

On top of that, you're using the provided 'type' and 'size' data from $_FILES array for your validation. Those fields are user-provided and can be subverted. Nothing says a malicious user can't upload "hackme.exe" or "subvert_my_server.php" and tag it as an image/jpeg type upload, and your script would happily try to store on the server.

For proper handling, something like this is better:

if ($_FILES['thumbfile']['error'] === UPLOAD_ERR_OK) {
    $info = getimagesize($_FILES['thumbfile']['tmp_name']);
    if (($info[2] !== IMG_GIF) && ($info[2] !== IMG_JPEG)) { // whoops. had || initially.
       die("not a gif/jpg");
    }
    if (filesize($_FILES['thumbfile']['tmp_name']) > 20000) {
       die("larger than 20000");
    }
    move_uploaded_file($_FILES['thumbfile']['tmp_name'], '/some/directory/on/your/server/filename.jpg');
}