PHP Issues - file uploads

[Marci]

Wotcha folks - have been on a mini mission of late writing a media library for the school's website. Basically I got sick of callouts to install blah codec to play blah video etc, so decided to shunt everything over to FLV thru the browser.

 

We're using a FreeBSD (with WHM / cPanel) server, and I've got Lame / ffMpeg / FLVTool2 running happily to convert files on the fly and add MetaData. I'm now trying to automate the process so that authorised users can upload their own videos, which the server will then convert and relocate. Now, my PHP skills are limited... I know how to do what I can already do, but beyond that I hit brick walls rapidly. I've got a working system in place already that scans directories for FLVs and builds playlists which then feed into JWPlayer so the whole streaming / playback side is fine. The issue now rests with getting the files on there and converted... in the past this has been done on my workstation and I've then ftp'd them up to the server, but I'm after an easier way.

 

Here's what I've got at the moment...

 

The Upload Form:

</pre><form enctype="multipart/form-data" action="processupload.php" method="POST">
   
   Send this file: 
   
<

 

processupload.php:

error_reporting(E_ALL);
ini_set("session.gc_maxlifetime","10800");
$uploaddir = '/INCOMINGPATH/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

echo '';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
   echo "File is valid, and was successfully uploaded.\n";
} else {
   echo "File upload was unsuccesful.\n";
}
if (chmod($uploadfile, 0744)) {
echo "CHMOD was succesful. \n";
} else {
echo "CHMOD failed. File is executable. \n";
}

$last_line = system('ffmpeg -i '.$uploadfile.' '.$uploadfile.'.flv', $retval);
$last_line = system('cat '.$uploadfile.'.flv | flvtool2 -U stdin '.$uploadfile.'.flv', $retval);
exec('rm '.$uploadfile.'');

echo 'Here is some more debugging info:';
print_r($_FILES);
print "";

?>

 

Now, here are my issues.

 

1 - I need it to limit the filetypes that can be uploaded to mpg, avi or mov...

2 - The filename of the flv file produced is currently originalfilename.originalextension.flv - I need to lose the original extension...

 

Any assistance would be immensely appreciated!

[Jona]

You can use $_FILES["userfile"]["types"] to get the file type. See this example on w3c: PHP File Upload

 

The cropping part should just be string manipulation, you might be able to do it just using strstr PHP: strstr - Manual

 

something like strstr($outputfilename,".",TRUE)

 

Hope that helps

 

Cheers

Jona

[Marci]

Ta muchly!!

 

So, processupload.php now reads as follows:

error_reporting(E_ALL);
ini_set("session.gc_maxlifetime","10800");
$uploaddir = '/home/horbury/public_html/beta/dynamic/push/incoming/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
if ((($_FILES['userfile']['type'] == "video/mpeg")
|| ($_FILES['userfile']['type'] == "video/msvideo")
|| ($_FILES['userfile']['type'] == "video/quicktime")
|| ($_FILES['userfile']['type'] == "video/x-ms-wmv"))
&& ($_FILES['userfile']['size'] < 104857600))
{
echo '';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
   echo "File is valid, and was successfully uploaded.\n";
} else {
   echo "File upload was unsuccesful.\n";
}
if (chmod($uploadfile, 0744)) {
echo "CHMOD was succesful. \n";
} else {
echo "CHMOD failed. File is executable. \n";
}

$last_line = system('ffmpeg -i '.$uploadfile.' '.$uploadfile.'.flv', $retval);
$last_line = system('cat '.$uploadfile.'.flv | flvtool2 -U stdin '.$uploadfile.'.flv', $retval);
exec('rm '.$uploadfile.'');

echo 'Here is some more debugging info:';
print_r($_FILES);
print "";
}
else { echo "Invalid filetype - you may only upload files smaller than 100Mb ending in .mpg, .avi or .mov.\n"; }
?>

 

Am still working on the outputfilename issue... will let you know!

 

I do have a further issue but that's unrelated - for some reason files over a certain size won't upload despite restrictions on the form and php being set to 100Mb, and max uploads and max posts being set to 100M in php.ini

 

Will concentrate on that one later!

[Jona]

If your thinking of user's uploading big files you'll want to provide some form of a progress bar so the user knows something is happening. I've used uber-uploader Uber-Uploader - Free File Upload Progress Bar but it's perl based so ymmv....

[Marci]

Outputfilename sorted... ended up using substr()...

 

error_reporting(E_ALL);
ini_set("session.gc_maxlifetime","10800");
$uploaddir = '/home/horbury/public_html/beta/dynamic/push/incoming/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
$origname = basename($_FILES['userfile']['name']);
$newname = substr($origname, 0, -4);
$newfile = $uploaddir . $newname;
if ((($_FILES['userfile']['type'] == "video/mpeg")
|| ($_FILES['userfile']['type'] == "video/msvideo")
|| ($_FILES['userfile']['type'] == "video/quicktime")
|| ($_FILES['userfile']['type'] == "video/x-ms-wmv"))
&& ($_FILES['userfile']['size'] < 104857600))
{
echo '';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
   echo "File is valid, and was successfully uploaded.\n";
} else {
   echo "File upload was unsuccesful.\n";
}
if (chmod($uploadfile, 0744)) {
echo "CHMOD was succesful. \n";
} else {
echo "CHMOD failed. File is executable. \n";
}

$last_line = system('ffmpeg -i '.$uploadfile.' '.$newfile.'.flv', $retval);
$last_line = system('cat '.$newfile.'.flv | flvtool2 -U stdin '.$newfile.'.flv', $retval);
exec('rm '.$uploadfile.'');

echo 'Here is some more debugging info:';
print_r($_FILES);
print "";
}
else { echo "Invalid filetype - you may only upload files smaller than 100Mb ending in .mpg, .avi or .mov.\n"; }
?>

 

Progress bar.... hmmm.... next job!

[el8linuxel8]

Id throw in a few escapeshellcmd()'s and also a switch() or preg_replace filter on the file extension...

 

Passing $uploadfile into into that system() is kinda scary, what happens if someone uploads a file named 'lol;rm -rf;.flv'.

 

this isnt quite as valid because you rm the uploaded file, but you should consider naming the uploaded file as something like md5($uploadfile) that way the user cant preserve the file extension, for example if they uploaded a .php and you didnt rm it then you would have a potentially dangerous php file in your webroot. You should also probably consider uploading those files in ../public_html so that users cannot access them directly and they can only interface with your application.

 

 

Great idea btw, i think il look at doing something similar!

[Marci]

Heh - getting beyond me fella... show me in code I can copy and paste...

 

But anyhoo, this'll be a closed system accessible only to teachers here that know the password... there's a step that CHMODs the uploaded file to prevent it being executable in the case of a php file being uploaded, but mimetype restricts phps from going up (hardly a concrete infallible method, but works for a restricted userbase)...

 

The rest of the system is as follows at the mo.

 

This scans folder and outputs an XML playlist... there's a separate one for each folder involved... and a separate folder for each subject area.

$filter = ".flv";
$directory = "SUBJECT/";    //<< ie: Eng / Maths / Science etc...
$site = "http://www.site.com/video/";

@$d = dir($directory);
if ($d) {
while($entry=$d->read()) {
$ps = strpos(strtolower($entry), $filter);
if (!($ps === false)) {
$items[] = $entry;
}
}
$d->close();
sort($items);
}

header("content-type:text/xml;charset=utf-8");
echo "\n";
echo " SUBJECT Media Playlist\n";
echo " http://www.site.com\n";
echo " \n";

foreach($items as $value)
{
 $title = preg_replace('/.flv/', '', $value);
 $title = preg_replace('/_/', ' ', $title);
 print "    \n";
 print "      "    . $title . "\n";
 print "      " . $site  . '/video/' . $directory . '/' . $value . "\n";
 print "    \n";
}

echo " \n";
echo "\n";
?>

 

And embedding the mediaplayer and calling the playlist:

                 Please enable Javascript to use our Media
                   Player
                 <br />
var so = new SWFObject('http://www.site.com/video/mediaplayer.swf','mpl','620','260','8');<br />
so.addParam('allowscriptaccess','always');<br />
so.addParam('allowfullscreen','true');<br />
so.addVariable('height','260');<br />
so.addVariable('width','620');<br />
so.addVariable('file','http://www.site.com/video/PLAYLIST.php'); // <<playlist.php = the code above<br />
so.addVariable('backcolor','0x000000');<br />
so.addVariable('frontcolor','0xffffff');<br />
so.addVariable('lightcolor','0xffffff');<br />
so.addVariable('displayheight','240');<br />
so.addVariable('displaywidth','350');<br />
so.addVariable('overstretch','fit');<br />
so.addVariable('showstop','true');<br />
so.addVariable('showdownload','false');<br />
so.addVariable('repeat','list');<br />
so.write('player');<br />

 

The player is from This site and the JW Player

Edited July 15, 2008 by Marci

[el8linuxel8]

$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

 

escapeshellcmd($uploadfile) otherwise if the user had a ; in the filename, when you run it through system() it will execute it as a seperate command, breaking out of your ffmpeg.

 

Its always fun to be secure

[contink]

There's a fair number of tutorials and references on cleaning your $_FILES input so no sense in repeating that here.

 

As regards your upload ceiling.. I'd look at anything that allows you to cut the upload into chunks, writing the buffer to file at each point instead of the default which is to upload the file into memory which in itself causes all manner of "fun". Can't remember how it's done but I was prompted to sort this myself when I wrote a file management system some years ago.

[el8linuxel8]

There's a fair number of tutorials and references on cleaning your $_FILES input so no sense in repeating that here.

 

Well he obviously didnt read one ey?

[Marci]

Righty... so as it currently stands...

 

error_reporting(E_ALL);
ini_set("session.gc_maxlifetime","10800");
$allowable_ext = array('avi','mpg','mov','wmv');
$pieces = explode('.', $_FILES['userfile']['name']);
$ext = $pieces[count($pieces) - 1];
if(!in_array($ext, $allowable_ext)) {
echo "Invalid filetype - you may only upload files smaller than 100Mb which end in .mpg, .avi, .wmv or .mov.\n";
exit;
}
$uploaddir = '/UPLOADPATH/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
$origname = basename($_FILES['userfile']['name']);
$newname = substr($origname, 0, -4);
$newfile = $uploaddir . $newname;
$uf = escapeshellcmd($uploadfile);
$nf = escapeshellcmd($newfile);
if ((($_FILES['userfile']['type'] == "video/mpeg")
|| ($_FILES['userfile']['type'] == "video/msvideo")
|| ($_FILES['userfile']['type'] == "video/quicktime")
|| ($_FILES['userfile']['type'] == "video/x-ms-wmv"))
&& ($_FILES['userfile']['size'] < 104857600))
{
echo '';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
   echo "File is valid, and was successfully uploaded.\n";
} else {
   echo "File upload was unsuccesful.\n";
}
if (chmod($uploadfile, 0744)) {
echo "CHMOD was succesful. \n";
} else {
echo "CHMOD failed. File is executable. \n";
}

$last_line = system('ffmpeg -i '.$uf.' '.$nf.'.flv', $retval);
$last_line = system('cat '.$nf.'.flv | flvtool2 -U stdin '.$nf.'.flv', $retval);
exec('rm '.$uf.'');

echo 'Here is some more debugging info:';
print_r($_FILES);
print "";
}
else { echo "Invalid filetype - you may only upload files smaller than 100Mb which end in .mpg, .avi or .mov.\n"; }
?>