Disable af PHP asp mm

Her er koden så



<head>
<style>
A:link {text-decoration: none; font-family:verdana; color: #000000}
A:visited {text-decoration: none; font-family:verdana; color: #000000}
A:active {text-decoration: none; font-family:verdana; color: #9CA6BD}
A:hover {text-decoration: none; color: #6B7A9C}
table {font-family:verdan; font-size: 8pt; color: #000000}
body {font-family:verdana; font-size: 8pt; color: #000000}
</style>
<title>.:: Upit.dk ::. - Keep it Simple and keep the dices rolling v2</title></head>
<?
//-- USER VARIABLE
$user_password = "test";
$admin_password = "adminpass";
//-- That's it! You don't need to touch below.

$site_name = $_SERVER['HTTP_HOST'];
$message = "";
//$message = "cookie_password = ".$_COOKIE['upload_password']. "<br>";
if (!$form_password)
$form_password = $_COOKIE['upload_password'] ;

$upload_dir = "/customers/upit.dk/upit.dk/httpd.www/upload/";
$url_dir = "http://www.upit.dk".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF']);
$url_this = "http://www.upit.dk".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];
$upload_url = $url_dir."/upload/";

//$message .= "form_password = $form_password <br>";
//$message .= "upload_files = ".$_COOKIE['upload_files'] ."<br>";

if ( $form_password==$user_password || $form_password==$admin_password)



if ($upload) {
$message .= do_upload($upload_dir, $upload_url);
}

if ($delete) {
if (unlink($upload_dir.$delete)) {
$message .= "Filen $delete er blevet slettet!";
$pos = strpos($_COOKIE['upload_files'], $delete );

//$message .= "delete=$delete<br>";
//$message .= "pos=$pos<br>";
//$message .= "1st=".substr($_COOKIE['upload_files'],0,$pos)."<br>";
//$message .= "2nd=".substr($_COOKIE['upload_files'],$pos+strlen($delete)+1)."<br>";

$new_cookie = substr($_COOKIE['upload_files'],0,$pos)."".
substr($_COOKIE['upload_files'],$pos+strlen($delete)+1);
setcookie('upload_files', $new_cookie);

}
}
else {

$message .= "";

}


function do_upload($upload_dir, $upload_url) {

if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {

$temp_name = $_FILES['userfile']['tmp_name'];
$file_name = $_FILES['userfile']['name'];
$file_type = $_FILES['userfile']['type'];
$file_size = $_FILES['userfile']['size'];
$result = $_FILES['userfile']['error'];
$max_size = $_REQUEST['MAX_FILE_SIZE'];
$file_url = $upload_url.$file_name;
$file_path = $upload_dir.$file_name;

if ( $file_size > $max_size) {
$message .= "Filen fylder mere end $max_size.";
return $message;
}

$new_file_name=$file_name;
$ver=1;
while ( file_exists($file_path) ) {
$ver++;
$new_file_name = $file_name."[".$ver."]";
$file_path = $upload_dir.$new_file_name;
$file_url = $upload_url.$new_file_name;
}

if ( move_uploaded_file($temp_name, $file_path) ) {
$message .= "

<br>
<br>
Fil Navn : $file_name <br>
Fil Type : $file_type <br>
Fil Størrelse : $file_size byte<br>
";



}

}
else {
if ( $file_name == "") {
$message .= "Ugyldig fil-navn";
return $message;
}
else
$message .= " Possible file upload attack: filename".$real_name;
}

return $message;
}

function display_files($upload_dir,$form_password, $admin_password) {



$upload_url = $url_dir."/upload/";

if ($handle = opendir($upload_dir));
else
return "ERROR: Cannot Open Directory $upload_dir";

$html = "";

$files_arr = explode( ":", $_COOKIE['upload_files'] );

while (false !== ($file = readdir($handle))) {

$delete_url = $url_this."?delete=".$file;;

if ($file =='..' || $file=='.');
else {
$count = $count+1;
if($count==4) { $html .= "</tr>";
$count = 1; }
if($count==1) { $html .= "<tr>"; }
$html .= "<td align=center><a href='$upload_url$file' target='about_blank'>$file</a></td>";
//$html .= "$file, $files_arr, $file_size $form_password, $admin_password <br>";
if ( in_array( $file , $files_arr, $file_size ) || $form_password == $admin_password )
$html .= "<td><a href='$delete_url'>Delete</a></td>";
else
$html .= "<td> </td>";
}
}

closedir($handle);

return $html;
}



?>

<body>
<table align=center border=0>
<tr><td align=center>
</td></tr>
<tr><td>

<form ENCTYPE="multipart/form-data" method="post" action="upload.php">
<table width=100%>
<tr><td>
<p>
<input type="hidden" name="MAX_FILE_SIZE" value="1000000">
<input type="hidden" name="form_password" size="10" value="test">
</p>
<p>Regler p&aring; UpIt.dk</p>
<p>1) Brug filnavne der beskriver hvad filen er eller ligne<br>
2) Upload <b>ikke</b> copyright indhold<br>
3) Upload <b>ikke</b> ulovligt matriale<br>
4) Upload <b>ikke</b> virus eller andet skadelig stuff<br>
5) Upload <b>ikke</b> pornografisk indhold<br>
<p><br>
Upload En Fil:
<input type="file" name="userfile" SIZE="25">
</p>
</td></tr>
<tr><td align=center>
<input type="submit" name="upload" value=" Upload ">
<input type="submit" name="refresh" value=" Opdater "></td></tr>
<tr><td><?=$message?></tr></tr>
</table>
</form></td></tr>
<tr><td>
<table width=100%>
<tr><td align=center><b>Uploadede Filer:</b></td></tr>
<table width=100%>
<tr><br><td align="center"><?=display_files($upload_dir,$form_password, $admin_password)?></td></tr>
</table></td></tr>
</table>
</body>

Du kan instille din server så filer i den mappe du uploader til ikke må blive udført.  eller du kan individuelt indstille de enkelte filer til ikke at måtte udføres af php

  chmod( "filstiognavn"; 0666 );  // nb: 0666 ikke bare 666

Læs:  http://dk2.php.net/chmod  men pas på det de beskriver gælder kun 100% på unixbaserede systemer (linux,zenix,...), filsystemet i windows er ikke så flexibelt, så hvis du er hosted på windows skal du ikke regne formeget med at fx kunne skelne imellem owner,group og world

mvh JakobA

Skriv her i

http://www.eksperten.dk/spm/427852

der giver det flere points (200)