Datei-Uploads in PHP verarbeiten: Größe erhöhen und Uploads validieren

<?php
try {
    echo 'upload_max_filesize: ' . ini_get('upload_max_filesize') . '<br>';
    echo 'post_max_size: ' . ini_get('post_max_size') . '<br>';
    echo 'max_file_uploads: ' . ini_get('max_file_uploads') . '<br>';
    echo 'memory_limit: ' . ini_get('memory_limit') . '<br>';
} catch (Exception $e) {
    error_log('Error checking PHP configuration: ' . $e->getMessage());
    echo 'Error checking configuration settings.';
}
?>

<?php
phpinfo();
?>

<IfModule mod_php.c>
    php_value upload_max_filesize 20M
    php_value post_max_size 25M
    php_value memory_limit 256M
    php_value max_execution_time 300
</IfModule>

php_admin_value[upload_max_filesize] = 20M
php_admin_value[post_max_size] = 25M
php_admin_value[memory_limit] = 256M

<form action="upload.php" method="post" enctype="multipart/form-data">
  <label for="file">Choose file to upload:</label>
  <input type="file" name="file" id="file" required />
  <input type="submit" value="Upload" />
</form>

<?php
declare(strict_types=1);

class FileUploadHandler {
    private string $uploadDirectory;
    private array $allowedTypes;
    private array $allowedExtensions;
    private int $maxFileSize;
    private array $uploadedFiles = [];

    public function __construct(
        string $uploadDirectory = '/var/lib/php-upload-demo/',
        array $allowedTypes = ['image/jpeg', 'image/png', 'application/pdf'],
        array $allowedExtensions = ['jpg', 'jpeg', 'png', 'pdf'],
        int $maxFileSize = 5242880 // 5MB
    ) {
        $this->uploadDirectory = rtrim($uploadDirectory, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
        $this->allowedTypes = $allowedTypes;
        $this->allowedExtensions = $allowedExtensions;
        $this->maxFileSize = $maxFileSize;

        $this->initializeUploadDirectory();
    }

    private function initializeUploadDirectory(): void {
        if (!is_dir($this->uploadDirectory)) {
            if (!mkdir($this->uploadDirectory, 0700, true)) {
                throw new RuntimeException('Failed to create upload directory');
            }
        }

    }

    public function handleUpload(): array {
        try {
            if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
                throw new RuntimeException('Invalid request method');
            }

            if (!isset($_FILES['file'])) {
                throw new RuntimeException('No file uploaded');
            }

            $file = $_FILES['file'];
            $this->validateUpload($file);

            $fileInfo = $this->processUpload($file);
            $this->uploadedFiles[] = $fileInfo;

            return [
                'success' => true,
                'message' => 'File uploaded successfully',
                'file' => $fileInfo
            ];

        } catch (Exception $e) {
            error_log('Upload error: ' . $e->getMessage());
            return [
                'success' => false,
                'message' => 'The file could not be uploaded. Check its type and size.'
            ];
        }
    }

    private function validateUpload(array $file): void {
        if (!isset($file['error'], $file['size'], $file['name'], $file['tmp_name']) ||
            !is_int($file['error']) || !is_int($file['size']) ||
            !is_string($file['name']) || !is_string($file['tmp_name'])) {
            throw new RuntimeException('Invalid upload fields');
        }
        if ($file['error'] !== UPLOAD_ERR_OK) {
            throw new RuntimeException($this->getUploadErrorMessage($file['error']));
        }

        if ($file['size'] > $this->maxFileSize) {
            throw new RuntimeException('File is too large');
        }

        $fileType = mime_content_type($file['tmp_name']);
        if (!in_array($fileType, $this->allowedTypes, true)) {
            throw new RuntimeException('Invalid file type');
        }

        $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
        if (!in_array($extension, $this->allowedExtensions, true)) {
            throw new RuntimeException('Invalid file extension');
        }

        if (!is_uploaded_file($file['tmp_name'])) {
            throw new RuntimeException('Invalid upload attempt');
        }
    }

    private function processUpload(array $file): array {
        $hash = hash_file('sha256', $file['tmp_name']);
        $extensions = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'application/pdf' => 'pdf'];
        $extension = $extensions[mime_content_type($file['tmp_name'])] ?? null;
        if ($extension === null) {
            throw new RuntimeException('No storage extension configured for this type');
        }
        $newFilename = bin2hex(random_bytes(16)) . '.' . $extension;
        $destination = $this->uploadDirectory . $newFilename;

        if (!move_uploaded_file($file['tmp_name'], $destination)) {
            throw new RuntimeException('Failed to move uploaded file');
        }

        chmod($destination, 0600);

        return [
            'name' => $file['name'],
            'type' => mime_content_type($destination),
            'size' => filesize($destination),
            'hash' => $hash,
            'filename' => $newFilename
        ];
    }

    private function getUploadErrorMessage(int $error): string {
        return match($error) {
            UPLOAD_ERR_INI_SIZE => 'File exceeds upload_max_filesize',
            UPLOAD_ERR_FORM_SIZE => 'File exceeds MAX_FILE_SIZE',
            UPLOAD_ERR_PARTIAL => 'File was only partially uploaded',
            UPLOAD_ERR_NO_FILE => 'No file was uploaded',
            UPLOAD_ERR_NO_TMP_DIR => 'Missing temporary folder',
            UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk',
            UPLOAD_ERR_EXTENSION => 'File upload stopped by extension',
            default => 'Unknown upload error'
        };
    }
}

// Usage
header('Content-Type: application/json');

try {
    $handler = new FileUploadHandler();
    echo json_encode($handler->handleUpload(), JSON_THROW_ON_ERROR);
} catch (Throwable $e) {
    error_log('Upload handler failed: ' . get_class($e));
    http_response_code(500);
    echo json_encode(['success' => false, 'message' => 'The upload service is unavailable.']);
}

<?php
function scanFile(string $filepath): bool {
    $path = realpath($filepath);
    if ($path === false || !is_file($path)) {
        return false;
    }
    $file = @fopen($path, 'rb');
    if ($file === false) {
        return false;
    }
    $socket = @stream_socket_client('unix:///var/run/clamav/clamd.ctl', $errno, $error, 5);
    if ($socket === false) {
        fclose($file);
        return false;
    }
    stream_set_timeout($socket, 30);
    $writeAll = function (string $bytes) use ($socket): bool {
        while ($bytes !== '') {
            $written = @fwrite($socket, $bytes);
            if ($written === false || $written === 0) {
                return false;
            }
            $bytes = substr($bytes, $written);
        }
        return true;
    };
    try {
        if (!$writeAll("zINSTREAM\0")) {
            return false;
        }
        while (!feof($file)) {
            $chunk = @fread($file, 8192);
            if ($chunk === false || ($chunk === '' && !feof($file))) {
                return false;
            }
            if ($chunk !== '' && !$writeAll(pack('N', strlen($chunk)) . $chunk)) {
                return false;
            }
        }
        if (!$writeAll(pack('N', 0))) {
            return false;
        }
        $result = '';
        while (strlen($result) < 4096) {
            $byte = @fread($socket, 1);
            if ($byte === false || $byte === '') {
                return false;
            }
            if ($byte === "\0") {
                return $result === 'stream: OK';
            }
            $result .= $byte;
        }
        return false;
    } finally {
        fclose($file);
        fclose($socket);
    }
}
?>

<?php
// Laravel example
use Illuminate\Http\Request;

class UploadController extends \Illuminate\Routing\Controller {
  public function upload(Request $request) {
    $request->validate([
        'file' => 'required|file|mimes:pdf,jpg,png|max:5120'
    ]);

    $path = $request->file('file')->store('uploads');
    return response()->json(['success' => true, 'path' => $path]);
  }
}