blueimp/jQuery-File-Upload — Issue #877: Filetype re-name -> Image type bypass
Author: Gojiras
Created: 2011-12-14 01:33:49+00:00
State: open

I've found that someone can easily change the name of their file to an image even if it wasn't an image to begin with (ex. stupiddoc.pdf renamed to stupiddoc.png). Normally this can be checked by using:

```php
getimagesize($_FILES['Filedata']['tmp_name'])
```

and checking to see if it yields a result. If I were going to place this somewhere to check if it is indeed an image, within which method would I place it?

I have some pretty 'smart' members that are able to bypass the profile image type of jpg|gif|png by renaming pdfs.