I think everyone can upload "image.php.jpg" or "image.html.jpg". You should use this to prevent uploading those kind of images:



I think that should do the trick. Also your security would be one step higher.

Nice Find !. Think Scripteen will use it?
I WONDER what is involved in making this (ANY?) script rock solid and hacker-resistant.
There are Security audit companies out there - but I dont know IF they supply a solution to flaws. (AND im sure its expensive)
Thank you Todx for the contribution

which file do I edit that into?

I suggest that this was intended for Scripteen to adapt and incorporate into the script for a future release.

Well, you have to edit the file uploader.php in directory inc, but dont modify the script by yourself, wait for scripteen to fix it. If he will use my code.

You can see this code in action, go to MY SITE and try uploading an image, with spaces and .php, it will rename everything to _. I realy hope you will fix security issues.



Yes it was.

i guess this code also solved the Foreing Language Character Problem http://www.scripteen.com/forum/bug-reports...-a-bug-t59.html

everyone can add their language characters manually to this code

That's correct ImageCrab. Lets hope he will use this code.

The problem with that code is that there are various file types that can be excuted with harmful data like

.php .php3 .php4 .php5 .phtml .pl .py .jsp .asp .aspx .htm .html .shtml .sh .cgi

To avoid this I have secured the images folder with .htaccess file to not to permit any files but image files to be run from there.

If you inport my script in your, than even if someone will upload a .php3 or any other number at the end, the array ".php" will still be changed into _.

I understand your persistence in safeguarding file execution by automatically altering the extension of the file. Whilst i DO believe this would be a reasonible safeguard I remember that we were looking to maintain a level of spider-friendliness and I suspect thats the path scripteen is pursuing. So although YOUR suggestion is a rock solid safeguard I feel its possibly unlikely Scripteen will adopt it (as a short-term fix) if he has progressed past and beyond that to a image renaming protocol that maintains the level of Spider-friendliness that we are all seeking.
Do not think I am shirking or belittling your proposal - just keeping other options Open

I know and understand what you mean.

I'll stop bothering Scripteen with this code.

you are not bothering me at all. but the thing is that I have applied some other ways to prevent uploading malicous files and they work fine and I'm now preparing the download package for version 1.4