无法将文件从一台服务器传输到另一台服务器

Question

Hello guys i'm having trouble uploading a file from my server to my friends server using php. At first i was getting a 26 error now i am getting this error:

Error: Possible file upload attack: filename ''.Array ( ) 1

Below is my code

<?php
 $ch = curl_init();
chmod("grademegood.us/uploadedfiles/hello.txt", 0755);

  $post =array(
  'file' => '@' . realpath('./uploadedfiles/hello.txt')
 );

 curl_setopt($ch, CURLOPT_POSTFIELDS,$post);
 curl_setopt($ch, CURLOPT_URL, "http://friendsdomain.com/upload.php");
 curl_setopt($ch, CURLOPT_POST,true);

 $data = curl_exec($ch);

 if (curl_errno($ch))
{
 print curl_errno($ch);
}
else
{
  curl_close($ch);
 }

 echo $data;

 ?>

This is the receiving side code:

<?php
$uploads_dir = './phpbackend/';
if(is_uploaded_file($_FILES['userfile']['tmp_name'])) 
{
  echo  "File ".  $_FILES['userfile']['name']  ." uploaded successfully to
 $uploads_dir/$dest.\n";
 $dest=  $_FILES['userfile'] ['name'];
 move_uploaded_file ($_FILES['userfile'] ['tmp_name'], "$uploads_dir/$dest");
} 
 else 
  {
    echo "Possible file upload attack: ";
    echo "filename '". $_FILES['userfile']['tmp_name'] . "'.";
    print_r($_FILES);
  }
?>

Please I need some assistance.

Answer 1

When you're setting up your cURL request you're setting up the POST variables with this:

  $post =array(
    'file' => '@' . realpath('./uploadedfiles/hello.txt')
    );

The array keys are the variable names sent in the $_POST data.

When you come to unpack the file on the receiving server you're looking for

is_uploaded_file($_FILES['userfile']['tmp_name']

where 'userfile' should be the variable name used in the POST request sent by the sending machine.

The variables created in the POST data must match the variable names used by the receiving machine or the two machines won't be able to identify the different fields correctly.

At present you're creating the POST data with your file in file , but your receiving machine is looking for the file in the userfile variable. Your test fails because the variable names don't match, hence the message.