[noppid]

Originally Posted by Dark Visor

Hmm... I don't have much experience on the part of reading and managing files...

What kind of exploits could there be? Or is that curl snippet safe enough?

The code I posted is a slight variation of the one you can find in the vBulletin process_image_upload() function, which is used for uploading URL avatars.. However, it has no is_uploaded_file check in there, unlike in attachments.

Things change, so will the code eventually. It's getting attention now and will be exploited eventually. But that's another subject. Following some of those links should tell you the details.

I would say the curl snippet is very safe in comparison. But that is subjective of course.

Are you pulling images? Does your code ask for a url and fetch the object on demand as opposed to an upload form?