johnnyq e11d8f3252 Harden checkFileUpload: drop content hashing for random storage names ...

Replace md5(file_contents)+randomString(2) naming with randomString(32).
No longer reads the file into memory (removes file_get_contents), so
validation is O(1) regardless of size or upload count. Add is_uploaded_file()
and UPLOAD_ERR_OK checks, use pathinfo() for extension extraction, and
return false consistently on all failures (oversize previously returned a
truthy error string that callers treated as a valid filename).

2026-07-16 19:18:08 -04:00

4.8 KiB

Raw Blame History

View Raw