how can I disable php file upload in wordpress

Question

I am trying to make upload avatar image for wordpress users in front end. I am using this code

$files = $_FILES['post_files'];

foreach($files as $file){

  if(is_array($file)){

    $uploaded_file_type = $file['type'];
    $allowed_file_types = array('image/jpg', 'image/jpeg', 'image/png', 'image/gif');
    if(!in_array($uploaded_file_type, $allowed_file_types)) {
      $errors['image_empty'] = __( 'this image is not valid', 'themename' );
    } 

  }

}

it's not allowing to upload php file , but if they change the php file extension as png or jpeg they can upload the php file to my server. I try to use getimagesize() but I couldn't, I am newbie for php. Or is there any other solution?

thanks for answers

Why do you need to check this? If they upload a PHP file as an image, the worst that will happen is the image won't show - your server won't run the PHP in it (unless it is really badly configured :)). — Tim Malone
– Tim Malone, Commented May 22, 2016 at 21:11
I am using dreamhost and if I can upload the shell.php I can reach all the files and can edit — Ayd In
– Ayd In, Commented May 22, 2016 at 21:22
@Ayd In just remove the $allowed_file_types = array('image/jpg', 'image/jpeg', 'image/png', 'image/gif'); of the foreach. It is not needed to redeclare it every time. — francisco
– francisco, Commented Apr 9, 2024 at 16:33

Fatih SARI · Accepted Answer · 2016-05-22 21:28:47Z

1

If you use Wordpress image uplaoder(media uploader vs.) use this:

For disable any file format:

add_filter('upload_mimes','remove_mime_types');
function remove_mime_types($mimes){
  unset( $mimes['mp4'] );
}

For enable any file format:

add_filter('upload_mimes','add_custom_mime_types');
function add_custom_mime_types($mimes){
   return array_merge($mimes,array (
     'ac3' => 'audio/ac3',
     'mpa' => 'audio/MPA',
     'flv' => 'video/x-flv',
     'svg' => 'image/svg+xml'
   ));
}

for more information visit paulund's article: https://paulund.co.uk/change-wordpress-upload-mime-types

answered May 22, 2016 at 21:28

Fatih SARI

4334 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

cokeman19 · Accepted Answer · 2024-04-05 13:44:18Z

0

Try this:


$files = $_FILES['post_files'];

foreach ($files['tmp_name'] as $key => $tmp_name) {
    $uploaded_file_type = $files['type'][$key];
    $allowed_file_types = array('image/jpg', 'image/jpeg', 'image/png', 'image/gif');

    // Check if file type is allowed
    if (!in_array($uploaded_file_type, $allowed_file_types)) {
        $errors['image_empty'] = __('This image is not valid', 'themename');
        continue; 
    }

    // Check if the file is really an image using getimagesize()
    $image_info = getimagesize($tmp_name);
    if ($image_info === false) {
        $errors['image_empty'] = __('This file is not an image', 'themename');
        continue; 
    }

}

edited Apr 5, 2024 at 13:44

cokeman19

2,4852 gold badges26 silver badges42 bronze badges

answered Apr 5, 2024 at 7:49

Tony Jake

11 bronze badge

1 Comment

Community Over a year ago

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.

Collectives™ on Stack Overflow

how can I disable php file upload in wordpress

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related