Skip to content

Instantly share code, notes, and snippets.

@tuckbloor
Created May 12, 2023 07:28
Show Gist options
  • Save tuckbloor/2664125e8773d878c9cfa10eab03c69f to your computer and use it in GitHub Desktop.
Save tuckbloor/2664125e8773d878c9cfa10eab03c69f to your computer and use it in GitHub Desktop.
laravel upload a file and protect against phar attack
if ($request->hasFile('file')) {
$file = $request->file('file');
$filePath = $file->store('uploads');
$signature = file_get_contents('phar://' . storage_path('app/' . $filePath) . '/.signature');
if ($signature !== 'GBMB') {
// Invalid PHAR file
Storage::delete($filePath);
// Handle error
}
// File is valid
// Do something with the file
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment