Looking through your code, I can't see any obvious reason why this would be a problem. Could it be a limitation of your Web server? Another thing to check could be to use Data::Dumper to examine the contents of the CGI object to see if everything is getting through. 
use Data::Dumper;
print $cgi->pre( Dumper( $cgi ) );

[download]
That will get you looking at the inside of the CGI object and it's a pretty hairy thing. Once you've verified that all of your filehandles are in there, you could possibly narrow things down. It's not for the faint of heart, though.

In the meantime, you might want to look at a rather significant security hole you have in your script: 

$file=~m/^.*(\\|\/)(.*)/; # strip the remote path and keep the filenam
+e 
$name = $2; 

open(LOCAL, ">$dir/$name") or die $!; #open file

[download]
See that little dot star at the end of your regex? I specify the right filename and you're toast. I could use that for reverse directory traversal and append a pipe to the end of the filename to cause it to be executed instead of opened. Got any programs on your system that you don't want a cracker to run?

Another problem with it is that there is no test for failure. If it does not match, $2 may have a value from a previous match. Since you're iterating over this, it's a BAD THING. Try the following regex. It assumes that only letters, numbers, and underscores are in your filename, plus the possibility of one extension delimited by one period. 

( $name ) = ( $file =~ /(\w+(?:\.\w+)?)$/ ); # Note the $ which anchor
+s to the end of string

[download]

As a style issue, you may want to rewrite the following: 

($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time
+);

[download]
Since you are only using the minutes and seconds from this, you can rewrite it as: 
my ( $sec, $min ) = (localtime( time ) )[0,1];

[download]
Last note: I was really trying to avoid touting my CGI course again (too much blowing my own horn is not a good thing), but I really thing you could benefit from my lesson on security. It's free and all you can eat.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

In reply to (Ovid - you have a security hole) Re(3): 52K ... by Ovid
in thread 52K maximum file upload? by Stamp_Guy

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.