CHAPTER 14 ■ WORKING WITH FILES

Finding the Temp Directory

The preferred approach for using the temporary directory is to use the temporary:// scheme. This will always point to the temporary directory that was set up on the system during the installation process.

Neutralizing Dangerous Files

Suppose you are using the public file download method and you have file uploads enabled. What will happen when someone uploads a file named bad_exploit.php? Will it run when the attacker hits http://example.com/sites/default/files/bad_exploit.php? Hopefully not, for three reasons. The first is that .php should never be in the list of allowed extensions for uploaded files. The second is the .htaccess file, which should be in sites/default/files/.htaccess (see Chapter 21). However, in several common Apache configurations, uploading the file exploit.php.txt may result in code execution of the file as PHP code (see http:// drupal.org/files/sa-2006-007/advisory.txt). That brings us to the third reason: file name munging to render the file harmless. As a defense against uploaded executable files, the following function is used.

file_munge_filename($filename, $extensions, $alerts = TRUE)

The $filename parameter is the name of the file to modify. The $extensions parameter is a spaceseparated string containing file extensions. The $alerts parameter is a Boolean value that defaults to TRUE and results in the user being alerted through drupal_set_message() that the name of the file has been changed. The file name, with underscores inserted to disable potential execution, is returned.

$extensions = variable_get('upload_extensions_default', 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp');

$filename = file_munge_filename($filename, $extensions, FALSE);

$filename is now exploit.php_.txt.

You can prevent file name munging by defining the Drupal variable allow_insecure_uploads to be 1 in settings.php. But this is usually a bad idea given the security implications.

file_unmunge_filename($filename)

This function attempts to undo the effects of file_munge_filename() by replacing an underscore followed by a dot with a dot:

$original = file_unmunge_filename('exploit.php_.txt);

$original is now exploit.php.txt.

Note that this will also replace any intentional occurrences of _. in the original file name.

339

340

CHAPTER 14 ■ WORKING WITH FILES

Figure 14-9. Life cycle of a private file download request

Implementations of hook_file_download() should return an array of headers if the request should be granted, or -1 to state that access to the file is denied. If no modules respond to the hook, then Drupal will return a 404 Not Found error to the browser.

341