How to secure PHP code for uploading avatar images?

Question

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image.

This is the code:

if ($image->valid()) {
            $mimeType = $image->mimeType();
            if ($mimeType !== 'image/jpeg' && $mimeType !== 'image/png') {
                return new DataResponse(
                    ['data' => ['message' => $this->l->t('Unknown filetype')]],
                    Http::STATUS_OK,
                    $headers
                );
            }

For example:

1. download image1.jpg

2. as you can see if you open the file image1.jpg file on notepad it hides PHP code ( phpinfo(); function in this case.

3. rename image1.jpg to image1.php, and try to upload it on the avatar upload form. It passes verification.

How to secure this code?

Answer 1

Since we don't know what processing is being done, we can't comment on how secure this is.

The only safe way to handle image uploads is:

1) never use the user supplied name/path (but you can store it / include it in output if properly escaped, but never write this back to your filesystem)

2) store the content outside of the document root and mediate all subsequent access via a control script

3) at upload, extract and create the image raster from the file and re-encode this into the file you will be keeping