Not really security related per se, but I think that it's wise to set a maximum file size that you'll accept so that someone doesn't try to fill up your disk.

You can do this easily (if you're using CGI.pm) with something like:

# Limit file sizes to 1 MB
use constant MAX_FILE_SIZE => 1_048_576;
$CGI::POST_MAX = MAX_FILE_SIZE;
[download]

You may also want to set a size limit on the directory that is holding the uploaded files. This could be done with something like:

# 100 MB limit on the size of the upload dir
use constant MAX_DIR_SIZE => 100 * 1_048_576;

sub dir_size {
    my $dir      = shift;
    my $dir_size = 0;
    my $file;

    # Loop through files and sum the sizes; doesn't descend down subdi
+rs.
    opendir DIR, $dir or die "Unable to open $dir: $!\n";
    $dir_size += -s "$dir/$file" while defined( $file = readdir DIR );
    closedir DIR;

    return $dir_size;
}

die 'Upload directory is full.'
  if ( dir_size('/path/to/dir') + $ENV{CONTENT_LENGTH} > MAX_DIR_SIZE 
+);
[download]

I can't really speak as I have not looked at you script, but have you thought about a username/password validation to upload..?

I am constintaly being asked to implement this.

The script is already in an area that is password protected and on top of that only certain users are allowed access to it. To top it off, it's on a secure intranet.
_____________________________________________________
mojobozo
word (wûrd)
interj. Slang. Used to express approval or an affirmative response to
something. Sometimes used with up. Source

The sort of "rule based" upload of files which you seek is something which I am working on for a new module called CGI::Upload::Rule, fashioned very much after the File::Find::Rule module.

perl -e 'print+unpack("N",pack("B32","00000000000000000000000111101001")),"\n"'

A snippet:


    my %file_ok = qw{
        .gif    1
        .jpg    1
        .htm    1
        .html    1
        .txt    1
        .doc    1
        .pdf    1
    };

and then....

    ($base,$path,$type) = fileparse($file,'\..*');


and finally...

    $type =~ tr/A-Z/a-z/;
    if (!$file_ok{$type}) {
        print "The type of file you tried to upload ($type) is not sup
+ported.";
        return;
    }
[download]

how's that?
UPDATE: Added the line to make the extension lowercase as some losers in my industry love CAP LOCK.
_____________________________________________________
mojobozo
word (wûrd)
interj. Slang. Used to express approval or an affirmative response to
something. Sometimes used with up. Source

I would not trust file extensions; File::MMagic seems to me a better solution; here is an untested snippet:

use File::MMagic;
$mm = new File::MMagic; # use internal magic file
# disable checks made against file extension
$mm->removeFileExts;
$type = $mm->checktype_filename("/somewhere/unknown/file");
...
[download]

$type will contain a MIME mediatype string.

HTH, Valerio