PHP + Mime Magic + Apache 2 = Disaster

While developing an application codenamed relay I had the job of figuring out what filetype files where. Now by first glance this seems easy.. oh just check the extension. Well this is a security risk. Because we thumbnailed images you could easily rename a executable to be a jpg and potentially executed code which is a big no no.

A little research later I found out about a mysterious “magic” file. And php had an extension for it. Ok so ill just uncomment the line in php.ini and it should work. So I did, I enable the extension. Added a magic mime line in php.ini as described by php.net Wrote a quick test.. something like

php

$type = mime_content_type(“c:/text.txt”);
echo $type;

php

I ran it in the console using php.exe and it worked. Very excited I implamented it in my code ran in through the webserver and I wasn’t getting anything back. Blank.

BEGIN DEBUGIN

Ok. Echo it straight out to look at results… NOTHING… weird
Try it in the console again… works… weird
Check apache’s configuration for anything funky NOTHING … weird
Try a test script in apace similar to the one i wrote above… NOTHING
Time to look at phpinfo().... In apache mime_magic support was blank…. ok now we’re getting somewhere….
Check phpinfo() in the console ahh yes its enabled…..

Problem Identified

Now to fix it…. To the forums. Blah blah blah specifiy where the magic file is in the ini.. its there…. check ini settings in apache … its there… restart apache countless times… nothing….

Back to php.net

Under mime there is a little warning… This extension has been deprecated as the PECL extension fileinfo provides the same functionality (and more) in a much cleaner way.

Cool we’re getting somewhere, so I got and installed fileinfo. Good thing there is barley any documentation. But I figured it out tested it in the console, and it told me I had a bad magic file. Reasearching I decided to try the magic file that came with apache. The didn’t give me the error but it told me every file type was “application/x-dpkg”... AWESOME it doesn’t work at all.

Weeks later

After using the extension to determine file types for a while

The saga continues. I do a bunch of crap, nothing seems to work. I download file.exe a GnuWin32 release. And try that out, and its a stand alone program that can correctly id files. Ok so i figured I’d just use the backticks ` and execute it. The thought of that made me angry just thinging about it And I guess I just suck but I could not make it work. BUT it did come with a magic file. I figured I would try it with the fileinfo extension….

Success

That worked, I just needed the correct magic file. Well the file.exe package can be downloaded here

• Mar 21, 05:44 PM
• •
• posted by Lamb