Ik zit met een probleem, steeds word er maar een CS Exploit geupload, bestandnaam: csh4ck.php.avi en toch kunnen ze nog steeds van die exploit gebruik maken, heeft er misschien iemand er een oplossing voor?

Alvast bedankt!

<?php 
ERROR_REPORTING(E_ALL); 

class uploadClass { 
    var $uploadDir; 
    var $customName; 
    var $errors; 
    var $ext; 
    var $checkExt; 
     
    function uploadClass ( $dir )  
    { 
        $this->errors = array (); 
        $this->customName = FALSE; 
        $this->checkExt = FALSE; 
         
        if ( is_writable ( $dir ) && file_exists ( $dir ) )  
            $this->uploadDir = $dir; 
        else 
            $this->errorLog ( $dir . ' is niet schrijfbaar, of bestaat niet', TRUE ); 
         
    } 
     
    function uploadFile ( $name )  {         
        if ( IsSet ( $_FILES [ $name ] ) && is_uploaded_file ( $_FILES [ $name ][ 'tmp_name' ] ) ) 
        {     
            if ( $this->extCheck ( $_FILES [ $name ][ 'name' ] ) )  
            { 
                if ( $this->customName )  
                { 
                    if ( copy ( $_FILES [ $name ][ 'tmp_name' ], $this->uploadDdir . $this->custom_name ) ) 
                        return TRUE; 
                    else 
                        return FALSE; 
                } 
                else 
                { 
                    if ( copy ( $_FILES [ $name ][ 'tmp_name' ], $this->uploadDir . $_FILES [ $name ][ 'name' ] ) ) 
                        return TRUE; 
                    else 
                        return FALSE; 
                } 
            } 
        }     
        else 
            $this->errorLog ( $name . 'bestaat niet als upload bestand', TRUE ); 
            return FALSE; 
    } 
     
    function possibleExtensions ( $extensions ) { 
        $this->checkExt = TRUE; 
        $temp = explode ( ',', $extensions ); 
        if ( Empty ( $this->ext[0] ) )  
            $this->ext = $temp; 
        else 
            array_merge ( $this->ext, $tmp ); 
    } 
     
    function extCheck ( $filename ) {  
        if ($this->checkExt) 
        { 
            $tmp = explode ( ".", $filename ); 
            if ( in_array ( end($tmp), $this->ext))  
                return TRUE; 
            else 
                return FALSE; 
        } 
        else 
            return TRUE; 
    } 
    function setName ( $name ) 
    { 
        $this->custom_name = $name; 
    } 
     
    function errorLog ( $error, $die = FALSE )  
    { 
        $this->errors[] = $error; 
         
        if ( $die ) 
            die ( print_r ( $this->errors ) ); 
    } 
} 
?> 

<?PHP 
if ( $_SERVER ['REQUEST_METHOD'] == 'POST')  
{ 
    $upload = new uploadClass( $_SERVER ['DOCUMENT_ROOT'] . '/movies/' ); 
    $upload->possibleExtensions ( 'mpg,wma,mov,flv,mp4,avi,qt,wmv,rm' ); 
     
    if ( $upload->uploadFile ( 'bestand' ) ) 
        echo 'hiephoi'; 
    else 
        echo 'neee :('; 
} 
?> 
<form enctype="multipart/form-data" method="post"> 
<input name="bestand" type="file" /><br /> 
<input type="submit" name="upload" value="Upload" /> 
</form> 
Waarom uploadClass verkeerd geschreven?
Upload_Class hoort het te zijn.

Reageren