2

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is?

I already changed the name, checked the file size (not in code below) and checked the file extension. But I'm wondering if that is enough.

Here is my code (I'm checking file size in an earlier function):

private function uploadFile($id) {
    $uploader = $this->_fileUploaderFactory->create(['fileId' => $id]);
    $uploader->setAllowRenameFiles(TRUE);
    $uploader->setFilesDispersion(TRUE);
    $uploader->setAllowCreateFolders(TRUE);
    $uploader->setAllowedExtensions(Helper::ALLOWED_FILE_UPLOADS);

    $path = $this->_fileSystem->getDirectoryRead(DirectoryList::VAR_DIR)
      ->getAbsolutePath();

    $uploader->save($path . '/myfiles', $id . '.' . $uploader->getFileExtension());

    return '/myfiles' . $uploader->getUploadedFileName();
  }

1 Answer 1

1

The above code only makes sure for the upload file extensions is the image type extensions. One more thing is needed here for security, make sure you checking for MIME type for that file, like:

$imageInfo = getimagesize( $_FILES['userfile']['tmp_name'] );
if ( $imageInfo['mime'] == ( "image/png" ) ||
    $imageInfo['mime'] == ( "image/jpeg" ) || 
    $imageInfo['mime'] == ( "image/gif" ) || 
    $imageInfo['mime'] == ( "image/psd" ) || 
    $imageInfo['mime'] == ( "image/bmp" ) ) {

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.