Check file type (FLV) before PHP upload file in temporary folder by reading only starting 3 bytes of file

Question

First 3 bytes of FLV file are signature "FLV". Now my question:

Is there any possibility in PHP to handle file uploads so that we can hook into the input stream of uploading file and check the first 3 bytes?

The scenario is i don't want the complete file to be uploaded (in temporary folder) and then check if the file is FLV or not, i just want to read first few bytes of uploading stream and if it is not "FLV" then return/exit.

The file needs to be uploaded by HTML based form. Can't rely on javascript,flash uploader or any client side validation workarounds i.e. need a pure PHP based solution.

I already know that PHP does not hand over control to our script until it finishes uploading file in temporary folder and populating global variables i.e $_POST $_GET $_FILES etc.

Also there is a somewhat similar question here: How to upload a file byte by byte in php

but answers does not satisfy my requirement/question.

Any ideas are really appreciated!

Thanks

Gist

Could you use: $file = fopen(..); if(fgets($file, 3) === "FLV"){..} fclose($file);? – Etch

@DannyBeckett please read the fopen manual here: link . It does not allow to connect to client PC for file upload. It does allow to open a file on server or files through supported protocol and neither of it fulfills my requirement – Gist

That's why I asked if you could use it... – Etch

Answer 1

First, set session.upload_progress.enabled in your php.ini.

Then, use session.upload_progress to track how many bytes have uploaded. Once you have reached the minimum threshold, check the temporary file being uploaded, it will be in $_SESSION[unique_key]['files'][0]['tmp_name']. If the file doesn't match, set $_SESSION[unique_key]["cancel_upload"] to TRUE, and the file will be rejected.

To get unique_key:

ini_get("session.upload_progress.prefix") . $_POST[ini_get("session.upload_progress.name")];

If the above does not work (I haven't tested it), then your only recourse would be to create your own custom handler for PHP either as an Apache module (or better, as a custom CGI application). There you could do your filtering.

Page

+1 to you. this is a question I had for long time. thank you very much. – Uranian

@Burhan Khalid, thanks for your answer. I came across with this before also, but there are two issues, 1: it only works with php 5.4 or above, 2nd: to track the progress i have to generate another request to server possibly via ajax i.e. have to use client side technique, which i mentioned in my question is not an option – Gist

This is nothing to do with client side, and you didn't mention any specific PHP version requirements. 5.4 is already the old stable (current stable is 5.5). – Page

@BurhanKhalid ok i can certainly cope up with version, but then how can i track the progress without generating 2nd request to server because the script through which i am uploading the file won't be accessible unless the file is completely uploaded. I have to generate another request to server to run your provided code (to track the progress) and that can only be done via some client side workaround OR is there any thing else, please let me know – Gist

You need to run PHP with the Apache module, and not under FastCGI (otherwise, this will only work once the file is completely uploaded). You also need to disable APC and make sure you don't have custom session id set; if these are not possible you have two options left - use a client side polling solution, or create your own custom handler for PHP. – Page

Iam running php as an apache module, no APC. Say i have upload.php where iam uploading the file (form action sets to upload.php). Now to track the progress as per your provided code i have to create another script say track.php and hit on it in regular intervals most probably via AJAX to track and cancel the upload if desired? Am i right? So how can i rule out AJAX here? – Gist

Answer 2

@burhan-khalid provided a more up to date and correct answer above.

Short Answer is no with your constraints.

You can not access that file with PHP until it has been uploaded to the server. After it is uploaded you can read it but not before, at least not without some type of client side software that would allow you to stream it to PHP instead of the normal form submission.

Whippersnapper

It is not possible with native php functions, i already know that, but PHP itself handles the file uploading to temporary folder so there should be some handlers/functions doing this, i need to know about them and if it's possible to hook on them – Gist

I know that my answer may have not satisfied you but downvoting a correct answer is not very nice. What I told you is correct. There simply isn't a way with a standard HTTP POST and PHP. If you want to create a flash client that will send it byte by byte through a pipe to a PHP file you can but that was not allowed by your constraints. – Whippersnapper

First of all i didn't down-voted as if i have to, i would have, the very first day you have posted. Secondly, your answer is NOT CORRECT. There is way for tracking File Upload Progress as @BurhanKhalid mentioned, not absolutely as per requirement but atleast there is a soluton with HTTP POST and PHP. – Gist

Sorry I stand corrected. I did not see @BurhanKhalid's answer when I noticed mine got down-voted. Still learning the system. – Whippersnapper