This topic has 14 replies, 3 voices, and was last updated 10 years ago by 
Hi,
1. the prepared statements are not working correctly. If you upload a php file instead a photo, then you are able to hijack the server. Please rework the prepared statements for the upload function and check if the file is a jpg, png or a gif-file. If the file is not a image file, then stop uploading the file.
2. I localized the advanced testimonials manager into german language, but all special characters where not shown correctly, e.g. f�r instead of für, Vollst�ndige instead of Vollständige and so on. Could you please provide a solution?
Thanks in advanced!
Best regards
Norman from pddv
P.S.: I am able to upload a php file, e.g. a php file with phpinfo();
Therefore I could do a lot of other things…
http://www.bannersmonster.com/scripts/advtestm/upload/141113teste.php
Hi Fem,
i don’t think that I changed the fonts.
Yes, of course:
https://www.deutsch-vietnamesisch-dolmetscher.com/testimonials/index.php
BR,
Norman
Please update testimonial/addnew.php after line 6 if ( $addtestmonial ) { and testimonials/admin/addnew.php after line 14 if ( $addtestmonial ) { with the following code to avoid hacking attacks through uploading php files or other files than images. Please adapt the error messages to the correct variables. It already should work. Feel free to implement and adapt the code for the next release
if (isset($_FILES["photo"]) AND ! $_FILES["photo"]["error"] AND ($_FILES["photo"]["size"] < 300000 )) {
$bildinfo = getimagesize($_FILES["photo"]["tmp_name"]);
if ($bildinfo === false) {
die("kein Bild");
} else {
$mime = $bildinfo["mime"];
$mimetypen = array (
"image/jpeg" => "jpg",
"image/gif" => "gif",
"image/png" => "png"
);
if (!isset($mimetypen[$mime])) {
die("nicht das richtige Format");
} else {
$endung = $mimetypen[$mime];
}
$neuername = basename($_FILES["photo"]["name"]);
$neuername = preg_replace("/\.(jpe?g|gif|png)$/i", "", $neuername);
$neuername = preg_replace("/[^a-zA-Z0-9_-]/", "", $neuername);
$neuername .= ".$endung";
$ziel = "upload/$neuername";
while (file_exists($ziel)) {
$neuername = "kopie_$neuername";
$ziel = "upload/$neuername";
}
if (@move_uploaded_file($_FILES["photo"]["tmp_name"], $ziel)) {
echo "Dateiupload hat geklappt";
} else {
echo "Dateiupload hat nicht geklappt";
}
}
}