File Uploader Image Security

Hi all,


Does the file uploader class perform all the necessary security checks to verify that a file is an image such as checking the actual first 20 or so bytes of the file, etc? 


Note: I already know about changing the file name, adding htaccess to the upload folder to prevent php scripts from running, etc.  This is about verifying the actual image itself as being an image.

Thanks,

Alan

Check out the documentation: https://www.codeigniter.com/user_guide/l...ght=upload

... adding htaccess to the upload folder to prevent php scripts from running ...

I've not seen this one. What does that look like?

If you browse the code in the upload library, I think you'll find it handles even more than you thought it would.

Expert Website Development - Temecula, CA
Community Auth For CodeIgniter 3

https://github.com/bcit-ci/CodeIgniter/b...d.php#L806

https://github.com/bcit-ci/CodeIgniter/b...d.php#L806

Should've pointed to this instead:

https://github.com/bcit-ci/CodeIgniter/b....php#L1206