#!/usr/bin/perl -w

use strict;
use CGI;

my $query = new CGI;

my $go_switch = $query->param('go_switch');

if ($go_switch){
    my $file1 = $query->param('file1');
    my $file_type = $query->param('file_type');
    if ($file_type eq "jpg" || $file_type eq "gif"){ #only allowing im
+ages here
        my $file_mod = "p000001";
        if ($file1) { # uploads the first file
            my $save_directory = "/var/www/storage/$file_mod.$file_typ
+e";
            print "$save_directory<BR>";
            my $BytesRead;
            my $Buffer;
            my $Filename = $file1;
            $Filename =~ s/^\.+//;
            my $File_Handle = $query->param('file1');
            open (OUTFILE,">>$save_directory");
            while (my $Bytes = read($File_Handle,$Buffer,1024)) {
                $BytesRead += $Bytes;
                print OUTFILE $Buffer;
            }
            close($File_Handle);
            close(OUTFILE);
            chmod (0666, "$save_directory");
        }
    }
}
[download]

A necessary evil in the current environment....:(

EEjack

I dont understand where the variables are suppose to be.. sorry!
Adam

Adam,

Since you are not using CGI.pm (and you should) you need to parse out incoming data.

But instead of doing that, you should use CGI.pm.

use strict would be another good thing. -w would be helpful as well.

EEjack

If you are using CGI.pm then the hidden fields are available through calls to the param method, just as the file upload FH is. So before writing the contents of the upload, get the values from the param method.

Hi, Its me again, the guy with the original problem. Right, heres the code I use so far for JUST uploading a file. It does not use CGI.pm. I wanted all the code on one page so I could see how it worked using my own variable names, etc. Here it is:

#!/usr/bin/perl
print "Content-type: text/html\n\n";
#SET MAXIMUM FILE SIZE
#################################################
$maxfilesize = 30508; # 30.2kb

#CHECK FILE SIZE
#################################################
$len = $ENV{'CONTENT_LENGTH'};
 if ($len > $maxfilesize) {
     print "file is bigger than 30.2kb, sorry\n";
     exit;
  }

#SET PATH VARIABLES
################################################
$|        = 1;
$upath    = "/absolute/path/to/upload/dir/";
$uindex   = "/absolute/path/to/upload/dir/upload.index";
$tempfile = $upath . $ENV{'REMOTE_ADDR'};
#READ IN BUFFER AND WRITE TO TEMP FILE
################################################

read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
open (x,">$tempfile");
print x $buffer;
close (x);

#OPEN TEMP FILE AND PROCESS IT
################################################
open (temp,$tempfile);

#PULL OUT MIME/MULTIPART
################################################
$_ = <temp>;
($vernum) = /(\d+)/;

# Next line of the file contains the filename in the format:
# filename="C:\windows\win.ini"
# KEEP ONLY PART WITHIN QUOTES
################################################
$_ = <temp>;
$filetemp = $1 if (/filename=\"(.*)\"/);

#REMOVE FULL PATH NAME
################################################
@pathz = (split(/\\/,$filetemp));
$filetempb = $pathz[$#pathz];
@pathza = (split('/',$filetempb));
$filename = $pathza[$#pathza];

#IF FILENAME IS BLANK, SHOW ERROR MESSAGE
###############################################
if ($filename eq "") {<br>
    print "Oops, the you did not give a valid file name\n\n";
    close(temp);
    `rm $tempfile`;
    }

#CREATE FILE IN UPLOAD DIR
###############################################
open (outfile, ">$upath$filename");

# Now we don't care about the Content-type of this, so<br> we'll pass 
+that up
$junk = <temp>;
$junk = <temp>;

#READ/WRITE ALL APART FROM MIME/MULTIPART BIT
##############################################
while (<temp>) {
   if (!(/-{28,29}$vernum/)) {
        print outfile $_;
        }
   }


#ALL DONE, CLOSE AND PRINT SUCCESS MSG
##############################################
close (temp);
close (outfile);
`rm $tempfile`;

print "Your file <i>$filename</i> has been successfully<br> transferre
+d to this site.<br>\n";
exit;
[download]

So theres the code, anyone know how I can pass through 3 VARIABLES too?. I do need the variables for security but at this stage the user has already logged in. I just like to constantly pass throught a username and password so that the .cgi script cant be accessed on its own without going through the login.

Im pretty new to all this so I really am sorry if I sound like a gimp. lol Really appreciate more help on this, thanks for all the replies everyone, Ill make sure I put you on the Thanks Page. :)

You'd be wanting to use CGI.pm, no really, you would.

You'd also want to be using warnings, strict and taint checking, particularly as you seem to trust the filename provided...

Have you considered getting a user account at perlmonks? it'd tell you about responses to questions when you log in then...

--
RatArsed

I've only used CGI.pm to parse query parms. But if you insist on doing it yourself, I think the hidden fields are going to be field=value pairs in STDIN that you apparently assume is just the uploaded file. Since you are writing everything to a temp file, take a look in there and see if you can find references to the hidden fields. HTH

So, any form data sent in the same form that uploads the file should be easily accessed.

BTW, the way you mention 3 HIDDEN VARIABLE VALUES, makes me terribly worried that you might think of using the values as some sort of security measure, which is not any sort of security at all... all hidden values are visible in the source code, and sent in cleartext over internet connections. If this is not the case, my apologies, and please disregard this last paragraph.

Ive posted the code up above, hope you can help