Upload Hack

Im a newbie at php, and this is my first hack, its a uploader i made that uses your vbulletin forum's accounts and pass to upload files into there private folder, it also lets people view what files they uploaded, it also logs when, who, what file was uploaded and the size of the forum to a text file. When some one uplaods it creates a sub folder thats the same as there username and a blank index.html file so no one can browse through there stuff and then uploads the image into there personal sub folder, you can also edit authvb to only alow certain usergroups to upload.

How to setup:
Open config.php and change the settings to how you want them
upload config.php,upload.php and authvb.php
chmod the folder where the log file will go and where the account sub folders will be places so there read and write, probily 0777

Thats it, now go to upload.php and use your vbulletin account and pass and upload a file

Coming soon:
Delete feature
File count limit

[ipscone]

I'm getting "Couldn't Copy File To Server" error. I have done some troublshooting on this...

1) I have checked the permissions and they are 777.
2) I have verified that the login is checked properly.
3) I have verified that the folder is created, for the user, when a file upload is attempted, in the upload directory.
4) I have verified that the copy path is correct. I put some test code in to see what the script thinks the path is and it returns:
/MyAbsolutePath/ipscone/MyTestFile.gif, which is the correct absolute path.
5) I have even manually copied a file to the upload/member folder and when I try to use the Upload.php program to upload that same file, it correctly sees that it's a duplicate. So that part works ok.
6) I have tried to view that directory with the View Files and even though there is one file that was manually copied, it doesn't display with the View Files.
7) I modified the upload.php file to do some debugging and found something I can't explain. In the case view: section, I modified the following:

$dir = opendir("$absolute_path/$PHP_AUTH_USER") 
       or $list .= "<tr><td>Error: Can't open $absolute_path/$PHP_AUTH_USER</td></tr>";
while($file = readdir($dir)) {{

to see that the absolute path was right and it was. Now, I know there is one file in the directory but the code within the while loop does not execute even once. Since there is one file there (manually placed) it should go through this loop, at least once. Why not?

Can there be an incompatibility with php 4.3.1 that I'm using?

But the file just won't copy. I get "Couldn't Copy File to Server".

Any idea what might be causing this error? opendir adn copy seem to fail.

Is this the only UPLOAD program that produces individual folders for each of the members?

What version is included in the first post in this thread? Is there a newer version somewhere?

[ipscone]

Ok, I have a clue to the symptoms but no answer to the problem yet.

The opendir() and copy() fail because of the way the directory is created. The script uses the following to create the upload directory

PHP Code:

if (!is_dir("$absolute_path/$PHP_AUTH_USER")) {
   $oldumask = umask(0);
   mkdir("$absolute_path/$PHP_AUTH_USER",0777); 
   umask($oldumask);
   if ($indexfile = 
        fopen("$absolute_path/$PHP_AUTH_USER/index.html", "a")) {
      $timenow = time();
      $name    = strip_tags($PHP_AUTH_USER);
      fwrite($indexfile, "");
      fclose($indexfile);
    }
} 


With this code, the directory is created but the owner is "apache." When the owner is apache, the opendir() and copy() don't work in the script.

But if I manually create any directory that I plan to use, instead of the program doing it, everything works fine. I can upload and the opendir() and copy() work fine.

How does one change the script to avoid this problem? I believe it is normal for "apache" to be the owner of something created from the script but why doesn't the copy() and opedir() work for a directory that has "apache" as the owner? Any way around this?

[ipscone]

Now, I'm thinking this inability to use copy() and opendir() has to do with the open_basedir configuration.

The program works perfectly, if I manually create the folder and set the permissions. But if the program creates the directory, I can't open or copy to it.

Anyone know how I can get around this and open and copy files, if this is the case? Or, if this is not the problem what is?

[kevinnguyen]

man, where's v2? it sounds great
any1 here knows how to add more upload boxes?

[LangTuDaTinh]

05-01-03 at 02:30 PM ipscone said this in Post #93
Now, I'm thinking this inability to use copy() and opendir() has to do with the open_basedir configuration.

The program works perfectly, if I manually create the folder and set the permissions. But if the program creates the directory, I can't open or copy to it.

Anyone know how I can get around this and open and copy files, if this is the case? Or, if this is not the problem what is?

i think u must go to telnet or SSH and change its chown from apache to that site's user.

[corsacrazy]

bump once again the creator if ur out there please share version 2 with us

[Nebby]

[ipscone]

Here is one I'm working on...

Photo album

[corsacrazy]

looks good is it intergrated in to users database?

[Nebby]

Can it be edited to work with MP3's?