Revisiting uploading a graphic w/ an OS X server

[phatnugs420@comcast.net]

Hi all, thanks for all your help last time.. Unfortunately I couldn't get
any of the suggestions to work and because of time constraints I had to go
to something that I knew worked... But I'd like to revisit this because I
really want this option to run locally on the os x server...

Basically I have this string of code:

<?php
if($file_name !="")
{
copy ("$file", "/Library/WebServer/Documents/olcg/admin/$file_name")
or die("Could not copy file");
}
else { die("No file specified"); }
// If a ITL has been submitted,
// add it to the database.

if (@mysql_query($ sql)) {
echo('<p><b><ce nter>Your Tile Ad has been uploaded and
updated.</center></b></p>');
} else {
echo('<p>Error adding submitted ITL: ' .
mysql_error() . '</p>');
}


?>
<strong>Your Tile Graphic Has Been uploaded. </strong>
<ul>
<li>Sent: <?php echo "$file_name "; ?>
<li>Size: <?php echo "$file_size "; ?> bytes
<li>Type: <?php echo "$file_type "; ?>
</ul>
<p><img src="<?php echo "$file_name " ?>"> </p>



I keep getting the error Could not copy file... When I look at the error log
it tells me:

[Thu Feb 3 09:57:22 2005] [error] PHP Notice: Undefined variable:
file_name in
/Library/WebServer/Documents/olcg/admin/edit/tilegraphicsubm it.php on line
32


When I move this to a linux server running php 4 and mysql (the exact same
thing this server is running) it works great. Any help would be appreciated
in helping me figure out why this isn't working.

[Brion Vibber]

Re: Revisiting uploading a graphic w/ an OS X server

phatnugs420@com cast.net wrote:[color=blue]
> <?php
> if($file_name !="")
> {
> copy ("$file", "/Library/WebServer/Documents/olcg/admin/$file_name")
> or die("Could not copy file");[/color]
[snip][color=blue]
> [Thu Feb 3 09:57:22 2005] [error] PHP Notice: Undefined variable:
> file_name in
> /Library/WebServer/Documents/olcg/admin/edit/tilegraphicsubm it.php on line
> 32[/color]

If that file is being run literally, then you have two problems.

First, it looks like you're coding to the register_global s option being
on, which is generally considered insecure and obsolete. The default is
to have this off. Go to http://www.php.net/register_globals for more
information.

Second, you've probably got a huge security hole, in that anyone with
access to this script over the web can copy arbitrary files on your
filesystem into web-readable space. You may also have SQL injection and
HTML/JavaScript injection vulnerabilities .

-- brion vibber (brion @ pobox.com)