Controlli di sicurezza per upload immagini

[webking2003]

Ciao a tutti, è la prima volta che mi imbatto nell'implementazione di uno script che permetta agli utenti di fare l'upload di immagini...
Sto utilizzando UberUploadCropper e volevo sapere quali sono i controlli di sicurezza PHP necessari per evitare il caricamento di shell (c99/r57 le più comuni) o comunque cose che possano fare danni seri..

Purtroppo non saprei da dove cominciare quindi attendo i vostri,sempre preziosissimi, consigli...

Vi posto il codice del file che viene richiamato dalla funzione asincrona:

upload.php

define('DS', DIRECTORY_SEPARATOR);
define('CURR_DIR', dirname(__FILE__) . DS);
define('UPLOAD_DIR', CURR_DIR . "uploads". DS);

require "../scripts".DS."fileuploader".DS."fileuploader.php";

$allowedExtensions = array('jpeg','jpg','gif','png','tiff','bmp');
$sizeLimit = 2 * 1024 * 1024; // max file size in bytes
$uploader = new qqFileUploader($allowedExtensions, $sizeLimit);

$result = $uploader->handleUpload(UPLOAD_DIR, false, md5(uniqid())); 

require "gd_image.php";
$gd = new GdImage();

// step 1: make a copy of the original
$filePath = UPLOAD_DIR . $result['filename'];
$copyName = $gd->createName($result['filename'], '_FULLSIZE');
$gd->copy($filePath, UPLOAD_DIR.$copyName);


// step 2: Scale down or up this image so it fits in the browser nicely, lets say 500px is safe
$oldSize = $gd->getProperties($filePath);
$newSize = $gd->getAspectRatio($oldSize['w'], $oldSize['h'], 500, 0);

$gd->resize($filePath, $newSize['w'], $newSize['h']);

// to pass data through iframe you will need to encode all html tags
echo json_encode($result);exit(); 

Vi ringrazio anticipatamente!!!!

[webking2003]

idee?

[webking2003]

Il file che esegue i controlli dovrebbe essere questo, ma non riesco a capire come integrare i controlli e quali fare in più per evitare quel problema..

class qqFileUploader {
    private $allowedExtensions = array();
    private $sizeLimit = 10485760;
    private $file;

    function __construct(array $allowedExtensions = array(), $sizeLimit = 10485760){        
        $allowedExtensions = array_map("strtolower", $allowedExtensions);
            
        $this->allowedExtensions = $allowedExtensions;        
        $this->sizeLimit = $sizeLimit;
        
        $this->checkServerSettings();       

        if (isset($_GET['qqfile'])) {
            $this->file = new qqUploadedFileXhr();
        } elseif (isset($_FILES['qqfile'])) {
            $this->file = new qqUploadedFileForm();
        } else {
            $this->file = false; 
        }
    }
    
    private function checkServerSettings(){        
        $postSize = $this->toBytes(ini_get('post_max_size'));
        $uploadSize = $this->toBytes(ini_get('upload_max_filesize'));        
        
        if ($postSize < $this->sizeLimit || $uploadSize < $this->sizeLimit){
            $size = max(1, $this->sizeLimit / 1024 / 1024) . 'M';             
            die("{'error':'increase post_max_size and upload_max_filesize to $size'}");    
        }        
    }
    
    private function toBytes($str){
        $val = trim($str);
        $last = strtolower($str[strlen($str)-1]);
        switch($last) {
            case 'g': $val *= 1024;
            case 'm': $val *= 1024;
            case 'k': $val *= 1024;        
        }
        return $val;
    }
    
    /**
     * Returns array('success'=>true) or array('error'=>'error message')
     */
    function handleUpload($uploadDirectory, $replaceOldFile = FALSE, $filename=''){
        if (!is_writable($uploadDirectory)){
            return array('error' => "Server error. Upload directory isn't writable.");
        }
        
        if (!$this->file){
            return array('error' => 'No files were uploaded.');
        }
        
        $size = $this->file->getSize();
        
        if ($size == 0) {
            return array('error' => 'File is empty');
        }
        
        if ($size > $this->sizeLimit) {
            return array('error' => 'File is too large');
        }
        
        $pathinfo = pathinfo($this->file->getName());
        if($filename == '') // 2011-12-09: Allow passing in a custom file name
            $filename = $pathinfo['filename'];
        //$filename = $pathinfo['filename'];
        //$filename = md5(uniqid());
        $ext = $pathinfo['extension'];

        if($this->allowedExtensions && !in_array(strtolower($ext), $this->allowedExtensions)){
            $these = implode(', ', $this->allowedExtensions);
            return array('error' => 'File has an invalid extension, it should be one of '. $these . '.');
        }
        
        if(!$replaceOldFile){
            /// don't overwrite previous files that were uploaded
            while (file_exists($uploadDirectory . $filename . '.' . $ext)) {
                $filename .= rand(10, 99);
            }
        }
        
        if ($this->file->save($uploadDirectory . $filename . '.' . $ext)){
            return array('success'=>true, 'filename'=>($filename.'.'.$ext), 'originalFilename'=>($pathinfo['filename'].'.'.$ext)); // 2011-12-09: Pass back the filename
        } else {
            return array('error'=> 'Could not save uploaded file.' .
                'The upload was cancelled, or server error encountered');
        }
        
    }    
}