File Uploads Via PERL And CGI

 
 
<!-- The data encoding type, enctype, MUST be specified as below -->

#! /usr/bin/perl -wT
 
# -w switch to make Perl warn us of any potential dangers in our code.
# -T switch turns on taint checking. This ensures that any untrusted 
# input to the script, such as the uploaded file's filename, is marked as tainted.
 
use strict;
use CGI;
use CGI::Carp qw ( fatalsToBrowser );
use File::Basename;
 
# Tto prevent the server being overloaded by huge file uploads, 
# the allowable size of an uploaded file can be limited to 2MB.
#
# 1024 bytes in 1 kB; 1024 kB in 1 MB (1048576 bytes in 1 MB)
$CGI::POST_MAX = 1024 * 1024 * 2;
 
# Some characters, such as slashes (/), are dangerous in filenames, 
# as they might allow file uploads to any directory. Alphabets,
# numerics, underscores, hyphens and periods may be considered safe.
my $safe_characters = "a-zA-Z0-9_.-";
 
# In Red Hat (like) distribtutions, the DocumentRoot variable in Apache
# is set by default to '/var/www/html'. Suppose that all uploaded files
# will be put into a folder called 'uploads' under DocumentRoot.
# 'uploads' folder must have 777 permission.
my $upload_location = "/var/www/html/uploads";
 
# The next step is to create a CGI object (assigned to $query below).
# This allows one to access methods in the CGI.pm library. One can then
# read in the filename of uploaded file.
my $query = new CGI;
 
# If there was a problem uploading the file -- for example, the 
# file was bigger than the $CGI::POST_MAX setting -- $filename 
# will be empty. The following bit tests for such problems.
#
# Value within param() is the same as the reference used in the form
my $filename = $query->param("uploaded_file");
 
if ( !$filename ) {
 print $query->header ( );
 print "There was a problem uploading the file. May be it is too big?.";
 exit;
}
 
# The first thing to do with filename is use the 'fileparse' routine in
# File::Basename module to split the filename into its leading path 
# (if any), the filename itself, and the file extension. One can then 
# safely ignore the leading path. Not only does this help prevent 
# attempts to save the file anywhere on the web server, but 
# some browsers send the whole path to the file on the user's hard drive.
my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );
$filename = $name . $extension;
 
# Convert any spaces in the filename to underscores
$filename =~ tr/ /_/;
 
# Remove any characters that are not in safe character list 
$filename =~ s/[^$safe_characters]//g;
 
# Untaint the $filename variable. 
# This variable is tainted because it contains potentially unsafe 
# data passed by the browser. The only way to untaint a tainted 
# variable is to use regular expression matching to extract the 
# safe characters:
if ( $filename =~ /^([$safe_characters]+)$/ ) {
 $filename = $1;
} else {
 die "Filename contains invalid characters";
}
 
# The upload method can be used to grab the file handle of the 
# uploaded file (which  points to a temporary file created by CGI.pm).
my $upload_filehandle = $query->upload("uploaded_file");
 
# One can now read the contents of the handle, its contents can be read
# and saved to a new file under 'uploads' folder. One can retain the
# uploaded file's name as the name of the new file.
open ( UPLOADFILE, ">$upload_location/$filename" ) or die "$!";
binmode UPLOADFILE;
 
while ( <$upload_filehandle> ) {
 print UPLOADFILE;
}
 
close UPLOADFILE;