saving mime image names

I was reviewing the mod discussed here (http://www.phpclasses.org/discuss/package/3169/thread/78/) to pull the inline image names from a message, but this involves writing the data to disk first.

There must be a way to save mime images with the supplied name instead of the content-id *without* 'SaveBody'=>'/path' enabled.

Content-Type: image/png;
name="icon-todo.png"
Content-Transfer-Encoding: base64
Content-ID: <[email protected]>
Content-Disposition: inline;
filename="icon-todo.png"

Does anyone have any ideas how to do this? Would help me a lot!

Thanks.

Right, the main problem is security. If a malicious message contains a file name that may overwrite an important file in your system (say a password file), you have opened a huge security hole.

I might add a function that lets you filter the file name at your own risk, but that would still be dangerous to inexperienced developers.

Yup, I understand that it could be a security risk if not implemented properly.

Would it be possible for you to write a mod or mod tutorial that would allow this AND security checks that would make it safe(r) using php->basename(), etc. to cleanse the name? I would really appreciate it. You can send it to be directly if you don't feel comfortable releasing it in the wild.

If you think about it, the standard attachment decoded and written with the given name has a similar security risk, so it would be a good thing to at least touch on for everyone IMO.

Thanks!

OK, I just uploaded a new version that has a new option variable that lets you tell the class to save the message body parts with the original file names at your own risk.

It will also checks if the file already exists and rename it if necessary to avoid attacks of messages that come with multiple files with the same name.

You're the best! I'll give it a try. If you accept donations, let me know where the button is so I can give something back for your efforts. :)

I'm looking for a variable set with the filename in the ["Headers"] array that I can key off of. I'm not saving the files to disk, so this is why I need a var set. I've been using the content-id var for the file name. Could you please show me how to set this var?

My usage:

$mime->use_part_file_names = 1;

$parameters=array(
'Data'=>$msg,

/* Read a message from a string instead of a file */
/* 'Data'=>'My message data string', */

/* Save the message body parts to a directory */
/* 'SaveBody'=>'/tmp', */

/* Do not retrieve or save message body parts */
'SkipBody'=>0,
);

Output:

["BodyPart"]=&gt;
int(2)
["BodyLength"]=&gt;
int(458)
}
[1]=&gt;
array(6) {
["Headers"]=&gt;
array(3) {
["content-type:"]=&gt;
string(10) "image/jpeg"
["content-transfer-encoding:"]=&gt;

string(6) "base64"
["content-id:"]=&gt;
string(39) "<[email protected]>"
NEEDED *****************************
["filename:"]=&gt;
string(16) "the-filename.ext"
*************************************
}
["Parts"]=&gt;
array(0) {
}
["Position"]=&gt;
int(2367)
["Body"]=&gt;
string(8704)(...blob...)

Forgot one thing. To clarify, I need to be able to link the content-id with the real filename. That's what I'm shooting for!

The class only generate a file name for each message part if it is intended to save the message parts to files.

In your case you can do that yourself after decoding the message.