阻止PHP中用png或jpg重命名的gif上传图像

Question

I've a upload system and the user only can upload png and jpg images, but, if user rename the gif image with .png , for example, the system upload the gif image normally, so, how to do to block the gif images and others extensions that are not png or jpg ? My code:

$imageNameBefore = $_FILES["the_image"]["name"];
$imageNameBeforeExt = basename($nomeImgAntes);
$imageNameExt = pathinfo($imageNameBeforeExt, PATHINFO_EXTENSION);
$allowedExt = array("jpg", "jpeg", "png");

if(!in_array($imageNameExt, $allowedExt )) {
    echo "Only images with extensions jpg or png are accepted!";
} else {
    $imageNameTmp = $_FILES["the_image"]["tmp_name"];
    $imageNameDir = "../photos";

    $nameImageEnd = md5($imageNameTmp).$imageNameExt;
    move_uploaded_file($imageNameTmp, ($imageNameDir.$nameImageEnd));

    imagedestroy($imageNameTmp);
}

Answer 1

Insteadof checking the file name check the contents of the file by either "parsing" the entire contents (ie loading the image eg into gd) or via magic bytes (ie some parts of the file that must be present and contain specific values to have at least a chance of being a valid png/jpeg image).

see
- http://docs.php.net/function.finfo-file
- http://docs.php.net/function.imagecreatefromjpeg
- http://docs.php.net/function.imagecreatefrompng