关于上传类的安全编码思考

<?php


class Upload {

    public $srcimg;   //原图片
    public $destimg;  //目标图片
    public $width;   //原图片的宽度
    public $height;   //原图片的高度
    public $type;   //原文件的图片类型
    public $tmp;   //上传图片的临时地址
    public $error;   //错误信息
    public $im;    // 创建一个临时的图片句柄
    public $new_name;  //上传文件的新名字
    public $font;     //水印字体
    public $bName;   //完成后大图名称
    public $sName;   //完成后小图名称
    public $cut;   //是否剪切图片到指定高度
    public $thumb_width;    //缩略图的宽度
    public $thumb_height;   //缩略图的高度
    public $uploadDir;  //上传的路径
    public $w_img;    //水印图片路径
    public $w_pos;    //水印位置
    public $w_txt;   //水印文字
    public $w_font;   //字体大小
    public $watermarktype; //0文字 1 图片
    public $watermarkw;  //水印宽度
    public $watermarkh;  //水印高度
    public $watermarkpct; //水印透明度
    public $watermarkq;  //水印质量
    public $w_color;  //字体颜色
    public $debug;   //是否显示调试信息
    public $ifWater;  //是否打水印
    public $randNum;  //随机唯一数字

    function __construct($srcimg, $tmp, $error) {
        $this->srcimg = $srcimg;
        $this->tmp = $tmp;
        $this->error = $error;
        $this->cut = 1;
        $this->font = ROOT_PATH . "/statics/images/mark/arial.ttf";
        $this->w_img = ROOT_PATH . "/statics/images/mark/mark.png";
        $this->w_font = 18;
        $this->w_color = '#ff0000';
        $this->w_text = 'www.0760t.com';
        $this->thumb_width = 120;
        $this->thumb_height = 150;
        $this->watermarktype = 1;
        $this->watermarkw = 300;
        $this->watermarkh = 300;
        $this->watermarkq = 100;
        $this->watermarkpct = 80;
        $this->randNum = rand(10000, 999999);
        $this->uploadDir = ROOT_PATH . "/uploadfiles/" . date('Y-m') . "/";
        $this->debug = false;
        $this->ifWater = true;
    }

    function img_upload() {
        //文件上传的方法
        $this->get_srcimg_type(); //判断源文件的图片类型
        $this->get_new_upload_name(); //上传的文件生成新的名字
        $this->check_error($this->error);
        $this->in_type();
        if (!is_dir($this->uploadDir)) {
            mkdir($this->uploadDir, 0777);
        }
        if (is_uploaded_file($this->tmp)) {
            if (move_uploaded_file($this->tmp, $this->new_name)) {
                if ($this->ifWater) {
                    $this->watermark($this->new_name, $this->new_name);
                }
                if ($this->debug) {
                    echo Config::lang("UPLOADSUCCESS");
                }
                return true;
            } else {
                if ($this->debug) {
                    echo Config::lang("FILECANNOTMOVEUPLOADFAIL");
                }
                exit;
            }
        } else {
            if ($this->debug) {
                echo Config::lang("FILEUPLOADATTACK");
            }
            exit;
        }
    }

    public function make_thumbnail() {
        //生成缩略图的方法
        $this->get_dest_imgpath();
        $this->make_im();
        $this->width = imagesx($this->im);
        $this->height = imagesy($this->im);
        $thumb_ratio = $this->thumb_width / $this->thumb_height;
        $ratio = $this->width / $this->height;
        if ($this->cut == 1) {  //是否裁剪
            if ($ratio >= $thumb_ratio) {
                $img = imagecreatetruecolor($this->thumb_width, $this->thumb_height);
                imagecopyresampled($img, $this->im, 0, 0, 0, 0, $this->thumb_width, $this->thumb_height, $this->height * $thumb_ratio, $this->height);
                imagejpeg($img, $this->destimg);
            } else {
                $img = imagecreatetruecolor($this->thumb_width, $this->thumb_height);
                imagecopyresampled($img, $this->im, 0, 0, 0, 0, $this->thumb_width, $this->thumb_height, $this->width, $this->width / $thumb_ratio);
                imagejpeg($img, $this->destimg);
            }
        } else {
            if ($ratio >= $thumb_ratio) {
                $img = imagecreatetruecolor($this->thumb_height * $thumb_ratio, $this->thumb_height);
                imagecopyresampled($img, $this->im, 0, 0, 0, 0, $this->thumb_height * $thumb_ratio, $this->thumb_height, $this->width, $this->height);
                imagejpeg($img, $this->destimg);
            } else {
                $img = imagecreatetruecolor($this->thumb_width, $this->thumb_width / $thumb_ratio);
                imagecopyresampled($img, $this->im, 0, 0, 0, 0, $this->thumb_width, $this->thumb_width / $thumb_ratio, $this->width, $this->height);
                imagejpeg($img, $this->destimg);
            }
        }
        imagedestroy($this->im);
        imagedestroy($img);
    }

    public function make_smallpicture() {
        //生成缩略图的方法
        $this->get_dest_imgpath();
        $this->make_im();
        $this->width = imagesx($this->im);
        $this->height = imagesy($this->im);
        $img = imagecreatetruecolor($this->width, $this->height);
        imagecopyresampled($img, $this->im, 0, 0, 0, 0,$this->width, $this->height, $this->width, $this->height);        //重采样拷贝部分图像并调整大小
        imagejpeg($img,$this->destimg,50);
        imagedestroy($this->im);
        imagedestroy($img);
    }

    private function check_error($error) {
        //检查文件上传传得错误;
        if ($error > 0) {
            switch ($error) {
                case 1:
                    echo Config::lang("FILEBIGGERTHANPHPINISET");
                    break;
                case 2:
                    echo Config::lang("FILEBIGGERTHANFORMFILES");
                    break;
                case 3:
                    echo Config::lang("JUSTUPLOADPARTOFFILE");
                    break;
                case 4:
                    echo Config::lang("NOTFILEBEUPLOAD");
                    break;
                case 6:
                    echo Config::lang("FILETEMPDIRUNKNOW");
                    break;
                case 7:
                    echo Config::lang("DISKCANBEWRITEUPLOADFAIL");
                    break;
                default:
                    echo Config::lang("UNKNOWERROR");
                    break;
            }
        }
    }

    private function get_srcimg_type() {
        //判断源文件的图片类型
        $this->type = substr(strrchr($this->srcimg, '.'), '1');
    }

    private function in_type() {
        //检查文件是否符合类型
        $type_arr = array('gif', 'jpg', 'jpeg', 'png', 'bmp', 'swf');
        if (!in_array($this->type, $type_arr)) {
            if ($this->debug) {
                echo Config::lang("JUSTACCEPTPNGGIFJPGTYPETRYAGGIN");
            }
            exit;
        }
    }

    private function get_new_upload_name() {
        //上传的文件生成新的名字
        $this->new_name = $this->uploadDir . date('YmdHi') . $this->randNum . '.' . $this->type;
        $this->bName = date('YmdHi') . $this->randNum . '.' . $this->type;
    }

    private function make_im() {
        //从原文件新建一幅图像
        switch ($this->type) {
            case 'jpg':
                $this->im = imagecreatefromjpeg($this->new_name);
                break;
            case 'gif':
                $this->im = imagecreatefromgif($this->new_name);
                break;
            case 'png':
                $this->im = imagecreatefrompng($this->new_name);
                break;
        }
    }

    private function get_dest_imgpath() {
        //得到缩略图的存储路径
        $len1 = strlen($this->new_name); //39
        $len2 = strlen(strrchr($this->new_name, '.')); //35
        $len3 = $len1 - $len2;
        $this->destimg = substr($this->new_name, 0, $len3) . '_s.' . $this->type;
        $this->sName = date('YmdHi') . $this->randNum . '_s.' . $this->type;
    }

    public function ImageCheck($image) {
        return extension_loaded('gd') && preg_match("/\.(jpg|jpeg|gif|png)/i", $image, $m) && file_exists($image) && function_exists('imagecreatefrom' . ($m[1] == 'jpg' ? 'jpeg' : $m[1]));
    }

    /**
     * 加水印
     */
    function watermark($source, $target = '') {
        if (!$this->ImageCheck($source))
            return false;
        if (!$target)
            $target = $source;
        $source_info = getimagesize($source);
        $source_w = $source_info[0];
        $source_h = $source_info[1];
        if ($source_w < $this->watermarkw || $source_h < $this->watermarkh)
            return false;
        switch ($source_info[2]) {
            case 1 :
                $source_img = imagecreatefromgif($source);
                break;
            case 2 :
                $source_img = imagecreatefromjpeg($source);
                break;
            case 3 :
                $source_img = imagecreatefrompng($source);
                break;
            default :
                return false;
        }
        if ($this->watermarktype == 1 && !empty($this->w_img) && file_exists($this->w_img)) {
            $ifwaterimage = 1;
            $water_info = getimagesize($this->w_img);
            $width = $water_info[0];
            $height = $water_info[1];
            switch ($water_info[2]) {
                case 1 :
                    $water_img = imagecreatefromgif($this->w_img);
                    break;
                case 2 :
                    $water_img = imagecreatefromjpeg($this->w_img);
                    break;
                case 3 :
                    $water_img = imagecreatefrompng($this->w_img);
                    break;
                default :
                    return false;
            }
        } else {
            $ifwaterimage = 0;
            $box = imagettfbbox($this->w_font, 0, $this->font, $this->w_text); //取得使用 truetype 字体的文本的范围
            $width = max($box[2], $box[4]) - min($box[0], $box[6]);
            $height = max($box[1], $box[3]) - min($box[5], $box[7]);
            $ax = min($box[0], $box[6]);
            $ay = min($box[5], $box[7]);
            unset($box);
        }
        $offset = 10;
        switch ($this->w_pos) {
            case 0:
                $wx = mt_rand($offset, ($source_w - $width - $offset));
                $wy = mt_rand($offset, ($source_h - $height - $offset));
                break;
            case 1:
                $wx = + $offset;
                $wy = + $offset;
                break;
            case 2:
                $wx = ($source_w - $width) / 2;
                $wy = + $offset;
                break;
            case 3:
                $wx = $source_w - $width - $offset;
                $wy = + $offset;
                break;
            case 4:
                $wx = + $offset;
                $wy = ($source_h - $height) / 2;
                break;
            case 5:
                $wx = ($source_w - $width) / 2;
                $wy = ($source_h - $height) / 2;
                break;
            case 6:
                $wx = $source_w - $width - $offset;
                $wy = ($source_h - $height) / 2;
                break;
            case 7:
                $wx = + $offset;
                $wy = $source_h - $height - $offset;
                break;
            case 8:
                $wx = ($source_w - $width) / 2;
                $wy = $source_h - $height - $offset;
                break;
            case 9:
                $wx = $source_w - $width - $offset;
                $wy = $source_h - $height - $offset;
                break;
        }
        imagealphablending($source_img, true);
        if ($ifwaterimage) {
            if ($water_info[2] == 3) {
                imagecopy($source_img, $water_img, $wx, $wy, 0, 0, $width, $height); //拷贝水印到目标文件
            } else {
                imagecopymerge($source_img, $water_img, $wx, $wy, 0, 0, $width, $height, $this->watermarkpct); //拷贝水印到目标文件
            }
        } else {
            if (!empty($this->w_color) && (strlen($this->w_color) == 7)) {
                $r = hexdec(substr($this->w_color, 1, 2));
                $g = hexdec(substr($this->w_color, 3, 2));
                $b = hexdec(substr($this->w_color, 5));
                $bjRGB = imagecolorallocate($source_img, $r, $g, $b);
                if (function_exists('imagettftext')) {
                    imagettftext($source_img, $this->w_font, 0, $wx - $ax, $wy - $ay, $bjRGB, $this->font, $this->w_text);
                } else {
                    imagestring($source_img, $this->w_font, $wx, $wy, $this->w_text, imagecolorallocate($source_img, $r, $g, $b));
                }
            } else {
                return false;
            }
        }
        switch ($source_info[2]) {
            case 1 :
                imagegif($source_img, $target);
                break;
            case 2 :
                imagejpeg($source_img, $target, $this->watermarkq);
                break;
            case 3 :
                imagepng($source_img, $target);
                break;
            default :
                return false;
        }
        if (isset($water_info)) {
            unset($water_info);
        }
        if (isset($water_img)) {
            imagedestroy($water_img);
        }
        unset($source_info);
        imagedestroy($source_img);
        return true;
    }

}

这里上传判断图片类型的方法

    private function get_srcimg_type() {
        //判断源文件的图片类型
        $this->type = substr(strrchr($this->srcimg, '.'), '1');
    }

    private function in_type() {
        //检查文件是否符合类型
        $type_arr = array('gif', 'jpg', 'jpeg', 'png', 'bmp', 'swf');
        if (!in_array($this->type, $type_arr)) {
            if ($this->debug) {
                echo Config::lang("JUSTACCEPTPNGGIFJPGTYPETRYAGGIN");
            }
            exit;
        }
    }

自己测试方案

<?php
$type =  substr(strrchr("I.sdsa1223.jpg","."), '1');
$type_arr = array('gif', 'jpg', 'jpeg', 'png', 'bmp', 'swf');
if (!in_array($type, $type_arr)) {

    echo 'fuck';

}
else
{
    echo "upload";
}
?>
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值